GHSA-4wrr-9h5r-m92w

Source

https://github.com/advisories/GHSA-4wrr-9h5r-m92w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4wrr-9h5r-m92w/GHSA-4wrr-9h5r-m92w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4wrr-9h5r-m92w

Aliases

CVE-2012-0391

Published

2022-05-04T00:29:43Z

Modified

2024-12-05T05:34:10.976089Z

Summary

Apache Struts Remote Java Code Execution

Details

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Database specific

{
    "nvd_published_at": "2012-01-08T15:55:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T20:37:05Z"
}

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.3.1

Affected versions

2.*

2.0.5

2.0.6

2.0.8

2.0.9

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.14

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

2.2.3

Maven / org.apache.struts.xwork:xwork-core