CVE-2012-0391: Apache Struts 2 Improper Input Validation Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-01-21
EPSS: 75.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-01-08 · updated 2026-06-16
Weakness: CWE-94

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Affected products

Apache Struts: before 2.2.3.1 — fixed in 2.2.3.1

How to fix

Upgrade to a fixed version: Apache Struts 2.2.3.1. Check the vendor advisory for mitigations.

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
http://secunia.com/advisories/47393
http://struts.apache.org/2.x/docs/s2-008.html
http://struts.apache.org/2.x/docs/version-notes-2311.html
http://www.exploit-db.com/exploits/18329
https://issues.apache.org/jira/browse/WW-3668
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
http://secunia.com/advisories/47393
http://struts.apache.org/2.x/docs/s2-008.html
http://struts.apache.org/2.x/docs/version-notes-2311.html
http://www.exploit-db.com/exploits/18329

Get alerted when CVE-2012-0391 or the next vulnerability affects your stack