CVE-2012-0394: apache struts Code Injection

CVSS: 6.8v2.0MediumModified

AliasesGHSA-hmvj-gc9q-mg9p

Published 08-01-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-0394 is a medium (CVSS 6.8) Code Injection vulnerability in apache struts. EPSS estimates a 72.90% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

52/100

0100

High · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

72.90%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Timeline

08-01-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

72.90%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 72.90% on 19-09-2026

19-09-202619-10-2026

EPSS score

72.90%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaseremotejavaVerified
Apache Struts - Developer Mode OGNL Execution (Metasploit)
Maturity: weaponized
exploit-databasemultipleVerified
Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities
Maturity: poc
MetasploitremoteVerified
Apache Struts 2 Developer Mode OGNL Execution
exploit/multi/http/struts_dev_mode
Maturity: weaponized