CVE-2012-0838

Published: Mar 2, 2012Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

Affected (1)

Products: Apache: Struts

Apache

1 product

Struts

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	From 2.0.0 to 2.2.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

http://jvn.jp/en/jp/JVN79099262/index.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://struts.apache.org/2.3.1.2/docs/s2-007.html

Source: secalert@redhat.com

Vendor Advisory

https://issues.apache.org/jira/browse/WW-3668

Source: secalert@redhat.com

Issue TrackingVendor Advisory

http://jvn.jp/en/jp/JVN79099262/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://struts.apache.org/2.3.1.2/docs/s2-007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://issues.apache.org/jira/browse/WW-3668

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.