CISA KEV 정보
| 취약점명 | Apache Struts 2 Improper Input Validation Vulnerability |
|---|---|
| 설명 | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution. |
| 조치사항 | Apply updates per vendor instructions. |
| 랜섬웨어 캠페인 악용 | Unknown |
| CWE | CWE-20 |
| 등록일 (KEV) | 2022-01-21 |
| 조치 기한 | 2022-07-21 |
| 추가 참고 | https://nvd.nist.gov/vuln/detail/CVE-2012-0391 |
NVD 상세 정보
CVSS v3.1: 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS v2.0: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C설명: The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CWE: CWE-20 | CWE-94
참조
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html [Broken Link, Exploit]
- http://secunia.com/advisories/47393 [Vendor Advisory]
- http://struts.apache.org/2.x/docs/s2-008.html [Vendor Advisory]
- http://struts.apache.org/2.x/docs/version-notes-2311.html [Vendor Advisory]
- http://www.exploit-db.com/exploits/18329 [Exploit]
- https://issues.apache.org/jira/browse/WW-3668 [Vendor Advisory]
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt [Broken Link, Exploit]
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html [Broken Link, Exploit]
- http://secunia.com/advisories/47393 [Vendor Advisory]
- http://struts.apache.org/2.x/docs/s2-008.html [Vendor Advisory]
- http://struts.apache.org/2.x/docs/version-notes-2311.html [Vendor Advisory]
- http://www.exploit-db.com/exploits/18329 [Exploit]
- https://issues.apache.org/jira/browse/WW-3668 [Vendor Advisory]
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt [Broken Link, Exploit]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391
This product uses the NVD API but is not endorsed or certified by the NVD.