CVE-2012-0391

critical

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

References

https://github.com/advisories/GHSA-4wrr-9h5r-m92w

https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391

https://issues.apache.org/jira/browse/WW-3668

http://www.exploit-db.com/exploits/18329

http://struts.apache.org/2.x/docs/version-notes-2311.html

http://struts.apache.org/2.x/docs/s2-008.html

http://secunia.com/advisories/47393

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html

Details

Source: Mitre, NVD

Published: 2012-01-08

Updated: 2026-06-16

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.75599