Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-0392 — Apache Struts vulnerability

8 documents8 sources
Severity
6.8MEDIUMNVD
EPSS
85.1%
top 0.64%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Struts
Timeline
PublishedJan 8
Latest updateMay 4

Description

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDapache/struts2.0.0 — 2.3.1

🔴Vulnerability Details

3
GHSA
Apache Struts's CookieInterceptor component does not use the parameter-name whitelist↗2022-05-04
▶
OSV
Apache Struts's CookieInterceptor component does not use the parameter-name whitelist↗2022-05-04
▶
CVEList
CVE-2012-0392: The CookieInterceptor component in Apache Struts before 2↗2012-01-08
▶

💥Exploits & PoCs

2
Exploit-DB
Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities↗2012-01-06
▶
Nuclei
Apache Struts2 S2-008 RCE
▶

📋Vendor Advisories

1
Red Hat
struts: arbitrary command execution via crafted HTTP Cookie header↗2011-12-25
▶

💬Community

1
Bugzilla
CVE-2012-0392 struts: arbitrary command execution via crafted HTTP Cookie header↗2012-01-11
▶