CVE-2012-0391

KEVApache Struts 2 Improper Input Validation Vulnerability

Description

The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedJan 8, 2012

Last modifiedJun 16, 2026

Added to KEVJan 21, 2022

Remediation dueJul 21, 2022

References

archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken LinkExploit
secunia.com/advisories/47393Vendor Advisory
struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
struts.apache.org/2.x/docs/version-notes-2311.htmlVendor Advisory
exploit-db.com/exploits/18329Exploit
issues.apache.org/jira/browse/WW-3668Vendor Advisory
sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken LinkExploit
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1559 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 75.6% · top 1% of all CVEs
Weakness: CWE-94
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.