Improper input validation in Apache Struts
CVE-2012-0838
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.139 (96.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.139 · newest: 0.139 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jvndb.jvn.jp/jvndb/JVNDB-2012-000012 (VDB Entry, Third Party Advisory, third-party-advisory)
- struts.apache.org/2.3.1.2/docs/s2-007.html (Vendor Advisory)
- issues.apache.org/jira/browse/WW-3668 (Issue Tracking, Vendor Advisory)
- jvn.jp/en/jp/JVN79099262/index.html (VDB Entry, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2012-0838?
- CVE-2012-0838 is a vulnerability in Apache Struts, classified under Improper Input Validation. Published 2012-03-02.
- Is CVE-2012-0838 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.