CVE-2012-0391

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

75.60% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-01-21

Published

2012-01-08

Updated

2025-10-22

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/18329

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_exce…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/18984
• https://www.exploit-db.com/exploits/18329

References

• CVE Record
• NVD entry

Related

• CVE-2012-0389
• CVE-2012-0392
• CVE-2012-0308
• CVE-2012-0393
• CVE-2012-0299
• CVE-2012-0394