PT-2011-1251 · Apache · Apache Struts 2+1

Hideyuki Suzumi · Published 2011-08-05 · Updated 2022-05-14 · CVE-2012-0838

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions prior to 2.2.3.1

Description The issue is related to insufficient input validation in the Apache Struts platform, allowing remote attackers to execute arbitrary code via invalid input to a field. This is due to the evaluation of a string as an OGNL expression during the handling of a conversion error, which enables the modification of run-time data values.

Recommendations For Apache Struts 2 versions prior to 2.2.3.1, update to version 2.2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting input validation to prevent the exploitation of this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-06203

CVE-2012-0838

GHSA-MWRX-HX6X-3HHV

Affected Products

Apache Struts

Apache Struts 2

References · 15

• http://struts.apache.org/2.3.1.2/docs/s2-007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0838 · Security Note
• https://osv.dev/vulnerability/GHSA-mwrx-hx6x-3hhv · Vendor Advisory
• https://issues.apache.org/jira/browse/WW-3668 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06203 · Security Note
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e · Note
• https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892 · Note
• https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b · Note
• https://access.redhat.com/security/cve/cve-2012-0838 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note
• https://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-000012.html · Note
• http://jvn.jp/en/jp/JVN79099262/index.html · Note
• https://cwiki.apache.org/confluence/display/WW/S2-007 · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012 · Note