logo

Database

Lack of data validation In org.apache.struts.xwork:xwork-core

Description

Apache Struts Code injection due to conversion error Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2012-08382. NVD-2012-08383. OSV-2012-08384. GCVE-2012-0838

References

1. https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e2. https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b3. https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f38924. https://issues.apache.org/jira/browse/WW-36685. http://jvn.jp/en/jp/JVN79099262/index.html6. http://jvndb.jvn.jp/jvndb/JVNDB-2012-0000127. http://struts.apache.org/2.3.1.2/docs/s2-007.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.