PT-2011-1251 · Apache · Apache Struts 2+1

Hideyuki Suzumi · Publicado 2011-08-05 · Atualizado 2022-05-14 · CVE-2012-0838

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions prior to 2.2.3.1

Description The issue is related to insufficient input validation in the Apache Struts platform, allowing remote attackers to execute arbitrary code via invalid input to a field. This is due to the evaluation of a string as an OGNL expression during the handling of a conversion error, which enables the modification of run-time data values.

Recommendations For Apache Struts 2 versions prior to 2.2.3.1, update to version 2.2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting input validation to prevent the exploitation of this issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2022-06203

CVE-2012-0838

GHSA-MWRX-HX6X-3HHV

Produtos afetados

Apache Struts

Apache Struts 2

Referências · 15

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e · Nota
• https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892 · Nota
• https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b · Nota
• https://access.redhat.com/security/cve/cve-2012-0838 · Nota
• http://struts.apache.org/2.3.1.2/docs/s2-007.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-0838 · Nota de Segurança
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Nota
• https://osv.dev/vulnerability/GHSA-mwrx-hx6x-3hhv · Aviso do Fabricante
• https://issues.apache.org/jira/browse/WW-3668 · Aviso do Fabricante
• https://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000012.html · Nota
• http://jvn.jp/en/jp/JVN79099262/index.html · Nota
• https://bdu.fstec.ru/vul/2022-06203 · Nota de Segurança
• https://cwiki.apache.org/confluence/display/WW/S2-007 · Nota
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012 · Nota