{"schemaVersion":3,"id":"CVE-2012-0391","aliases":["GHSA-4wrr-9h5r-m92w"],"status":"published","duplicateOf":null,"title":"Apache Struts 2 Improper Input Validation Vulnerability","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","dates":{"published":"2012-01-08T15:00:00.000Z","modified":"2025-10-22T00:05:48.504Z","reserved":null,"kevAdded":["2022-01-21T00:00:00.000Z"],"kevDue":["2022-07-21T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.75599,"percentile":0.99517,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.75599},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75599,"percentile":0.99517}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75599,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75599,"percentile":0.99517}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-21T00:00:00.000Z","dueDate":"2022-07-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apache Struts 2 Improper Input Validation Vulnerability","description":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","label":"nvd.nist.gov/vuln/detail/CVE-2012-0391"}],"vendor":"Apache","product":"Struts 2","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-01-21T00:00:00.000Z","dueDate":"2022-07-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apache Struts 2 Improper Input Validation Vulnerability","description":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","label":"nvd.nist.gov/vuln/detail/CVE-2012-0391"}],"vendor":"Apache","product":"Struts 2","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_59BCD5C7A60308BB","name":"Exploit Reference (archives.neohapsis.com)","source":"reference","url":"http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_2BD10F21C40D0271","name":"Exploit Reference (sec-consult.com)","source":"reference","url":"https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"18984","name":"Apache Struts 2.2.1.1 - Remote Command Execution (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/18984","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/18984.rb","codes":["CVE-2012-0391","OSVDB-78277"]},"metasploit":null},{"id":"18329","name":"Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities","source":"exploit-database","url":"https://www.exploit-db.com/exploits/18329","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/18329.txt","codes":["CVE-2012-0394","CVE-2012-0393","CVE-2012-0392","CVE-2012-0391","OSVDB-78277","OSVDB-78276","OSVDB-78109","OSVDB-78108"]},"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_STRUTS_CODE_EXEC_EXCEPTION_DELEGATOR","name":"Apache Struts Remote Command Execution","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/struts_code_exec_exception_delegator.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/struts_code_exec_exception_delegator","rank":"600","rankName":"excellent","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":5,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"apache","product":"struts","name":"struts","label":"struts","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.3.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-struts","label":"Apache Struts","category":"framework"}},"hubHref":"/vendor/apache/struts"},{"vendor":"org.apache.struts","product":"struts2-core","name":"org.apache.struts:struts2-core","label":"struts2-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.struts/struts2-core","purlType":"maven","versions":[{"text":"< 2.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.3.1","eol":null,"hubHref":null},{"vendor":"org.apache.struts.xwork","product":"xwork-core","name":"org.apache.struts.xwork:xwork-core","label":"xwork-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.struts.xwork/xwork-core","purlType":"maven","versions":[{"text":"< 2.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.3.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.exploit-db.com/exploits/18329","label":"www.exploit-db.com/exploits/18329","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","WEB"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","label":"archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","hostname":"archives.neohapsis.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link","Exploit","WEB"]},{"url":"http://struts.apache.org/2.x/docs/version-notes-2311.html","label":"struts.apache.org/2.x/docs/version-notes-2311.html","hostname":"struts.apache.org","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"http://struts.apache.org/2.x/docs/s2-008.html","label":"struts.apache.org/2.x/docs/s2-008.html","hostname":"struts.apache.org","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","label":"www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","hostname":"www.sec-consult.com","tags":["X Refsource MISC","Broken Link","Exploit","WEB"]},{"url":"https://issues.apache.org/jira/browse/WW-3668","label":"issues.apache.org/jira/browse/WW-3668","hostname":"issues.apache.org","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"http://secunia.com/advisories/47393","label":"secunia.com/advisories/47393","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory","WEB"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource","WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","label":"nvd.nist.gov/vuln/detail/CVE-2012-0391","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","label":"github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b","label":"github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892","label":"github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/struts","label":"github.com/apache/struts","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-01-08T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-01-21T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apache Struts 2 Improper Input Validation Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-07-21T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:48.504Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T07:20:16.971Z","stale":false,"partial":false}}