CVE-2012-0393
MEDIUM 6.4EPSS 36.3%
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
- CVSS v2.0 NVD
- 6.4 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:P - EPSS
- 36.32% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2012-01-08
- Updated
- 2024-09-16
Proof-of-concept exploits (1)
ExploitDB entries (1)
Security advisories
- http://struts.apache.org/2.x/docs/s2-008.html
- http://struts.apache.org/2.x/docs/version-notes-2311.html
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
- http://secunia.com/advisories/47393
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabili…
- advisories/GHSA-hxqq-w4mr-mc62