Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 75.1%; technical severity is CVSS 9.8.
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Who should care
- Teams operating Struts, Struts 2
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Struts, Struts 2 is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Vendor advisory from secunia.com
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-20
- Affected versions
- Apache Struts (End Excluding 2.2.3.1); Apache Struts 2
- Fixed versions
- Apache Struts (Fixed from 2.2.3.1)
- Published
- 8 January 2012
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 75.1%
- Signal calculated at 82
External references
- CISA Government advisory CVE-2012-0391
- Exploit information from archives.neohapsis.com
- Secunia Technical reference
- Struts Apache Technical reference S2 008
- Struts Apache Technical reference Version Notes 2311
- Exploit information from www.exploit-db.com
- Issues Apache Technical reference WW 3668
- Exploit information from www.sec-consult.com