PT-2012-1241 · Apache · Apache Struts

René Gielen · Publicado 2012-08-03 · Atualizado 2022-05-17 · CVE-2012-4387

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.4

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending specially crafted requests with very long parameter names, which are processed as OGNL expressions. This is related to insufficient access controls in the Apache Struts platform.

Recommendations For Apache Struts versions 2.0.0 through 2.3.4, consider restricting access to parameters that could be used to cause a denial of service, or apply configuration changes to limit the processing of long parameter names as OGNL expressions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2022-06204

CVE-2012-4387

GHSA-HRGC-54MV-58GV

Produtos afetados

Apache Struts

Referências · 18

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa · Nota
• https://github.com/apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4387 · Nota de Segurança
• https://openwall.com/lists/oss-security/2012/09/01/5 · Nota
• https://osv.dev/vulnerability/GHSA-hrgc-54mv-58gv · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78183 · Nota
• http://openwall.com/lists/oss-security/2012/09/01/5 · Nota
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Nota
• http://secunia.com/advisories/50420 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/09/01/4 · Nota
• http://securityfocus.com/bid/55346 · Nota
• http://struts.apache.org/2.x/docs/s2-011.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-06204 · Nota de Segurança
• https://cwiki.apache.org/confluence/display/WW/S2-011 · Nota