Skip to content

Apache Struts Code injection due to conversion error

High severity GitHub Reviewed Published May 14, 2022 to the GitHub Advisory Database • Updated Dec 27, 2023

Package

maven org.apache.struts.xwork:xwork-core (Maven)

Affected versions

< 2.2.3.1

Patched versions

2.2.3.1
maven org.apache.struts:struts2-core (Maven)
< 2.2.3.1
2.2.3.1

Description

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

References

Published by the National Vulnerability Database Mar 2, 2012
Published to the GitHub Advisory Database May 14, 2022
Reviewed Nov 3, 2022
Last updated Dec 27, 2023

Severity

High

EPSS score

1.889%
(89th percentile)

Weaknesses

CVE ID

CVE-2012-0838

GHSA ID

GHSA-mwrx-hx6x-3hhv

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.