CVE-2012-0391
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Apache Struts improperly processes user input as code during error handling, allowing attackers to execute arbitrary Java commands on the server. This is a critical vulnerability that can completely compromise the affected system.
The ExceptionDelegator in Apache Struts < 2.2.3.1 evaluates parameter values as OGNL expressions during exception handling triggered by type mismatches, enabling remote code execution without authentication. An attacker can craft parameters that exploit this expression language evaluation to execute arbitrary Java code with server privileges.
The full analysis of this CVE is available in Portuguese →