Servers and applications
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 21 Jan 2022.
- Severity
- Critical 9.8
- Published
- 8 Jan 2012
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.2.3.1
- Exploit chance
- 76% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Code injection (CWE-94)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache StrutsServers and applications · cpe:a:apache:struts |
|
Known exploited
- CISA name
- Apache Struts 2 Improper Input Validation Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 21 Jul 2022
- Used in ransomware
- Not known