CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary…

published January 8, 2012

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.9th percentile for exploit probability.

CVSS
—
EPSS
98%
Percentile
99.9
In the wild
Unconfirmed
What it is

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.97534 · 99.9th percentile
Published
2012-01-08T15:00Z
EPSS history
Timeline
  • 08 JAN 15:00Z
    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary…
    cvelistv5