{"id":"CVE-2012-0391","kind":"vulnerability","aliases":["CVE-2012-0391"],"related":[],"title":"Apache Struts 2: Apache Struts 2 Improper Input Validation Vulnerability","description":"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","summary":"Apache Struts 2 before 2.2.3.1 has an input validation flaw in its ExceptionDelegator component. A remote attacker can send crafted input to execute code on the server.","severity":"critical","cvss":9.8,"epss":0.75599,"exploited":true,"exploited_at":"2022-01-21T00:00:00+00:00","products":[{"name":"Apache Struts 2","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","package","self-hosted","struts2"],"not_affected_if":["struts-not-used","version-2.2.3.1-or-later"],"how_to_check":null,"fix":"Upgrade Apache Struts 2 to 2.2.3.1 or later, per vendor instructions (CISA KEV required action).","status":"open","published_at":"2012-01-08T15:55:01+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:04+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:29:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Struts 2 to 2.2.3.1 or later, per vendor instructions (CISA KEV required action).","reach":"internet","impact":"high","summary":"Apache Struts 2 before 2.2.3.1 has an input validation flaw in its ExceptionDelegator component. A remote attacker can send crafted input to execute code on the server.","category":"package","who_cares":["java","struts2","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the server remotely.","analyst_note":"Confirm the exact affected version range and a version-detection method from the NVD or Apache Struts advisory for CVE-2012-0391, since the sources give only the 'before 2.2.3.1' bound.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["struts-not-used","version-2.2.3.1-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000464,"input_tokens":2834,"output_tokens":361,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0391':13A,16A '-2012':12A,15A '2':3A,6A,19A,29B '2.2.3.1':31B,61C 'allow':79C 'apach':1A,4A,27B,58C 'apache':17A 'arbitrari':84C 'attack':43B,81C 'certain':69C 'code':50B,86C 'compon':40B,56C 'craft':46B,89C 'cve':11A,14A 'data':74C 'except':70C 'exceptiondeleg':39B,55C 'execut':49B,83C 'exploit':20B 'express':67C 'flaw':36B 'handl':71C 'host':25B 'improp':7A 'input':8A,34B,47B 'interpret':62C 'java':21B,85C 'mismatch':73C 'ognl':66C 'packag':22B 'paramet':63C,90C 'properti':77C 'remot':42B,80C 'self':24B 'self-host':23B 'send':45B 'server':53B 'strut':2A,5A,28B,59C 'struts':18A 'struts2':26B 'type':75C 'valid':9A,35B 'valu':64C 'via':87C 'vulner':10A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-01-08T15:55:01+00:00","kev":{"dateAdded":"2022-01-21","dueDate":"2022-07-21","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2012-0391","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-0391","severity":null,"published_at":"2022-01-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2012-0391","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0391","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2012-0391","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","severity":null,"published_at":"2012-01-08T15:55:01+00:00","modified_at":"2026-06-16T23:37:12+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}