PT-2012-1239 · Apache · Apache Struts

René Gielen · Published 2012-08-03 · Updated 2022-05-17 · CVE-2012-4386

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.4

Description The issue is related to the implementation of the token check mechanism in Apache Struts, which does not properly validate the token name configuration parameter. This allows remote attackers to perform cross-site request forgery (CSRF) attacks. The exploitation of this issue can enable an attacker to execute unauthorized requests.

Recommendations For Apache Struts versions 2.0.0 through 2.3.4, update to a version that properly validates the token name configuration parameter to prevent CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2022-05908

CVE-2012-4386

GHSA-2RVH-Q539-Q33V

Affected Products

Apache Struts

References · 15

• https://bdu.fstec.ru/vul/2022-05908 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4386 · Security Note
• http://struts.apache.org/2.x/docs/s2-010.html · Vendor Advisory
• http://secunia.com/advisories/50420 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rvh-q539-q33v · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4386 · Note
• http://xforce.iss.net/xforce/xfdb/7818 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78182 · Note
• http://openwall.com/lists/oss-security/2012/09/01/4 · Note
• http://securityfocus.com/bid/55346 · Note
• https://openwall.com/lists/oss-security/2012/09/01/5 · Note
• https://cwiki.apache.org/confluence/display/WW/S2-010 · Note
• http://openwall.com/lists/oss-security/2012/09/01/5 · Note
• https://issues.apache.org/jira/browse/WW-3858 · Note