GHSA-hxqq-w4mr-mc62

Source

https://github.com/advisories/GHSA-hxqq-w4mr-mc62

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hxqq-w4mr-mc62/GHSA-hxqq-w4mr-mc62.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hxqq-w4mr-mc62

Aliases

CVE-2012-0393

Published

2022-05-04T00:29:43Z

Modified

2024-12-03T06:02:47Z

Summary

Apache Struts's ParameterInterceptor component does not prevent access to public constructors

Details

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-27T20:24:03Z",
    "nvd_published_at": "2012-01-08T15:55:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3.1.1

Affected versions

2.*

2.0.5

2.0.6

2.0.8

2.0.9

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.14

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

2.2.3

2.2.3.1

2.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hxqq-w4mr-mc62/GHSA-hxqq-w4mr-mc62.json"

Maven / org.apache.struts.xwork:xwork-core