Vulnerability DatabaseCVE-2012-0392
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2012-0392
January 08, 2012
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Related Resources (12)
http://struts.apache.org/2.x/docs/version-notes-2311.html
https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.html
http://secunia.com/advisories/47393
https://github.com/apache/struts
https://web.archive.org/web/20120612142634/https://sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
https://nvd.nist.gov/vuln/detail/CVE-2012-0392
http://www.exploit-db.com/exploits/18329
https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
https://web.archive.org/web/20140723153720/http://secunia.com/advisories/47393
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
http://struts.apache.org/2.x/docs/s2-008.html
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.6
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
CVSS v2
Base Score:
6.8
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
EPSS
Base Score:
90.58