CVE-2012-0392
Summary
| CVE | CVE-2012-0392 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-01-08 15:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-noinfo | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| NEOHAPSIS - Peace of Mind Through Integrity and Insight | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | Broken Link |
| Version Notes 2.3.11 - Apache Struts 2 Wiki - Apache Software Foundation | af854a3a-2127-422b-91ae-364da2661108 | struts.apache.org | Release Notes, Vendor Advisory |
| [Dailydave] Apache Struts | af854a3a-2127-422b-91ae-364da2661108 | lists.immunityinc.com | Exploit, Third Party Advisory |
| 404 - Page not found! - SEC Consult | af854a3a-2127-422b-91ae-364da2661108 | www.sec-consult.com | Broken Link |
| Apache Struts2 <= 2.3.1 Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| S2-008 - Apache Struts 2 Wiki - Apache Software Foundation | af854a3a-2127-422b-91ae-364da2661108 | struts.apache.org | Vendor Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 996711 Java (Maven) Security Update for org.apache.struts.xwork:xwork-core (GHSA-2ppp-xj34-vvf7)