CVE-2012-0391

9.8 CRITICAL CISA KEV - Actively Exploited
Published: January 08, 2012 Modified: October 22, 2025
View on NVD

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
Source: cve@mitre.org
Broken Link Exploit
http://secunia.com/advisories/47393
Source: cve@mitre.org
Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html
Source: cve@mitre.org
Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html
Source: cve@mitre.org
Vendor Advisory
http://www.exploit-db.com/exploits/18329
Source: cve@mitre.org
Exploit
https://issues.apache.org/jira/browse/WW-3668
Source: cve@mitre.org
Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
Source: cve@mitre.org
Broken Link Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Exploit
http://secunia.com/advisories/47393
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://struts.apache.org/2.x/docs/s2-008.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.exploit-db.com/exploits/18329
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://issues.apache.org/jira/browse/WW-3668
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

15 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
89.5%
100th percentile
Exploitation Status
Actively Exploited
Remediation due: 2022-07-21

Weaknesses (CWE)

CWE-20 CWE-94

Affected Vendors

apache

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3