9.8Crítica
KEV
CVE-2012-0391Apache Struts 2 Improper Input Validation Vulnerability
Explotación conocida — Apache Struts 2 Improper Input Validation Vulnerability
CISA confirmó el 21.01.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 21.07.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-0391
Descripción
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Debilidad (CWE):
CWE-94
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- 18329 exploitExploit
- 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 mailing-listBroken LinkExploit
- http://struts.apache.org/2.x/docs/version-notes-2311.html Vendor Advisory
- http://struts.apache.org/2.x/docs/s2-008.html Vendor Advisory
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt Broken LinkExploit
- https://issues.apache.org/jira/browse/WW-3668 Vendor Advisory
- 47393 third-party-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*< 2.2.3.1