CVE-2012-0392: apache struts

EPSS trend

Probability

97.53%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 97.53% on 18-09-2026

18-09-202618-10-2026

EPSS score

97.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (lists.immunityinc.com)
Maturity: unknown
exploit-databasemultipleVerified
Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities
Maturity: poc

References

12 links

www.exploit-db.com/exploits/18329ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB EntryWEB
archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlMailing ListX Refsource BUGTRAQBroken LinkWEB
struts.apache.org/2.x/docs/version-notes-2311.htmlX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
struts.apache.org/2.x/docs/s2-008.htmlX Refsource CONFIRMVendor AdvisoryWEB
www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtX Refsource MISCBroken Link
lists.immunityinc.com/pipermail/dailydave/2012-January/000011.htmlMailing ListX Refsource MLISTExploitThird Party AdvisoryWEB
secunia.com/advisories/47393Third Party AdvisoryX Refsource SECUNIA
nvd.nist.gov/vuln/detail/CVE-2012-0392Advisory
github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427eWEB
github.com/apache/strutsPACKAGE

Show all 12 references

Related vulnerabilities

CVE-2018-1327apache software foundationapache struts+28.65%8y ago27-03-2018 21:00The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.CVE-2018-11776apache software foundationapache struts+9KEV99.99%8y ago22-08-2018 13:00Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.CVE-2013-2134apachestruts+270.21%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.CVE-2013-2115apachestruts+274.64%13y ago10-07-2013 19:00Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.CVE-2013-2251apachearchiva+4KEV100.00%13y ago18-07-2013 01:00Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.CVE-2013-2135apachestruts+213.83%13y ago16-07-2013 18:00Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

All vulnerabilities instruts

CVE-2012-0392: apache struts

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References