GitHub Advisory DatabaseGHSA-HXQQ-W4MR-MC62Apache Struts's ParameterInterceptor component does not prevent access to public constructors
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.9 Medium
AI Score
Confidence
High
0.919 High
EPSS
Percentile
98.9%
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.struts:struts2-core | lt | 2.3.1.1 | |
| org.apache.struts.xwork:xwork-core | lt | 2.2.3.1 |
References
archives.neohapsis.com/archives/bugtraq/2012-01/0031.html
struts.apache.org/2.x/docs/s2-008.html
struts.apache.org/2.x/docs/version-notes-2311.html
www.exploit-db.com/exploits/18329
github.com/advisories/GHSA-hxqq-w4mr-mc62
github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e
github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d
nvd.nist.gov/vuln/detail/CVE-2012-0393
web.archive.org/web/20120612142634/https://sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
web.archive.org/web/20140723153720/secunia.com/advisories/47393
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.9 Medium
AI Score
Confidence
High
0.919 High
EPSS
Percentile
98.9%