CVE-2012-4387

Published: Sep 5, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

Affected (35)

Products: Apache: Struts

Apache

1 product

Struts

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	Version 2.0.0
Apache Struts	Version 2.0.10
Apache Struts	Version 2.0.11.1
Apache Struts	Version 2.0.11.2
Apache Struts	Version 2.0.11
Apache Struts	Version 2.0.12
Apache Struts	Version 2.0.13
Apache Struts	Version 2.0.14
Apache Struts	Version 2.0.1
Apache Struts	Version 2.0.2
Apache Struts	Version 2.0.3
Apache Struts	Version 2.0.4
Apache Struts	Version 2.0.5
Apache Struts	Version 2.0.6
Apache Struts	Version 2.0.7
Apache Struts	Version 2.0.8
Apache Struts	Version 2.0.9
Apache Struts	Version 2.1.0
Apache Struts	Version 2.1.1
Apache Struts	Version 2.1.2
Apache Struts	Version 2.1.3
Apache Struts	Version 2.1.4
Apache Struts	Version 2.1.5
Apache Struts	Version 2.1.6
Apache Struts	Version 2.1.8.1
Apache Struts	Version 2.1.8
Apache Struts	Version 2.2.1.1
Apache Struts	Version 2.2.1
Apache Struts	Version 2.2.3.1
Apache Struts	Version 2.2.3
Apache Struts	Version 2.3.1.1
Apache Struts	Version 2.3.1.2
Apache Struts	Version 2.3.1
Apache Struts	Version 2.3.3
Apache Struts	Version 2.3.4