PT-2012-1241 · Apache · Apache Struts

René Gielen · Published 2012-08-03 · Updated 2022-05-17 · CVE-2012-4387

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.4

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending specially crafted requests with very long parameter names, which are processed as OGNL expressions. This is related to insufficient access controls in the Apache Struts platform.

Recommendations For Apache Struts versions 2.0.0 through 2.3.4, consider restricting access to parameters that could be used to cause a denial of service, or apply configuration changes to limit the processing of long parameter names as OGNL expressions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-06204

CVE-2012-4387

GHSA-HRGC-54MV-58GV

Affected Products

Apache Struts

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2012-4387 · Security Note
• https://osv.dev/vulnerability/GHSA-hrgc-54mv-58gv · Vendor Advisory
• http://secunia.com/advisories/50420 · Vendor Advisory
• http://struts.apache.org/2.x/docs/s2-011.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06204 · Security Note
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa · Note
• https://github.com/apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9 · Note
• https://openwall.com/lists/oss-security/2012/09/01/5 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78183 · Note
• http://openwall.com/lists/oss-security/2012/09/01/5 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note
• http://openwall.com/lists/oss-security/2012/09/01/4 · Note
• http://securityfocus.com/bid/55346 · Note
• https://cwiki.apache.org/confluence/display/WW/S2-011 · Note