{"id":"CVE-2011-3923","published":"2019-11-01T13:57:37Z","modified":"2024-08-06T23:53:32Z","title":"Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class…","vendor":"Apache","product":"Struts","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache","product":"Struts","versions":["2.3.1.2"]}],"description":{"text":"Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the ParameterInterceptor class of Apache Struts, in versions before 2.3.1.2, where security protections can be bypassed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:53Z"},"cvss":null,"epss":{"score":0.89492,"percentile":0.99785,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.exploit-db.com/exploits/24874","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/bid/51628","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-3923","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2014/Jul/38","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id?1026575","tags":["x_refsource_MISC"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72585","tags":["vdb-entry","x_refsource_XF"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.3.1.2"],"patched":["2.3.1.2"],"from":["GHSA-j68f-8h6p-9h5q"],"provenance":"source"}],"advisories":[{"id":"GHSA-j68f-8h6p-9h5q","url":"https://github.com/advisories/GHSA-j68f-8h6p-9h5q","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.3.1.2"],"patched":["2.3.1.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1771","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1771","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":24874,"url":"https://www.exploit-db.com/exploits/24874","title":"Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2013-03-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2013-03-22"},"metasploit":[{"name":"Apache Struts ParametersInterceptor Remote Code Execution","module":"exploit/multi/http/struts_code_exec_parameters","type":"exploit","disclosureDate":"2011-10-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb"}],"first":{"date":"2011-10-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/24874"],"flow":[],"timeline":[{"date":"2011-10-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2013-03-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb","provenance":"source"},{"date":"2019-11-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2011-3923","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}