PT-2011-1252 · Apache · Apache Struts

Andreas Nusser

+1

·

Publicado

2011-12-25

·

Atualizado

2022-05-04

·

CVE-2012-0392

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.1.1
Description The issue is related to the CookieInterceptor component, which does not utilize a parameter-name whitelist. This allows remote attackers to execute arbitrary commands by crafting a specific HTTP Cookie header, triggering Java code execution through a static method. The vulnerability is associated with inadequate access control in the implementation of the CookieInterceptor class.
Recommendations For versions prior to 2.3.1.1, update to version 2.3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the CookieInterceptor component to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-269

Identificadores relacionados

BDU:2022-06343
CVE-2012-0392
GHSA-2PPP-XJ34-VVF7

Produtos afetados

Apache Struts