{"id":"CVE-2012-0394","published":"2012-01-08T15:00:00Z","modified":"2024-08-06T18:23:30Z","title":"The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors.  NOTE: the vendor characterizes this behavior as not \"a security vulnerability itself.","provenance":"source","from":"CVE.org"},"summary":{"text":"The DebuggingInterceptor component in Apache Struts, before version 2.3.1.1, contains a flaw that is reachable when developer mode is enabled. An attacker can execute arbitrary commands via unspecified vectors, and the conditions required (such as network access or authentication) are not specified.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:50Z"},"cvss":null,"epss":{"score":0.729,"percentile":0.99449,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://struts.apache.org/2.x/docs/version-notes-2311.html","tags":["x_refsource_MISC"]},{"url":"http://struts.apache.org/2.x/docs/s2-008.html","tags":["x_refsource_MISC"]},{"url":"http://www.exploit-db.com/exploits/18329","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.exploit-db.com/exploits/31434","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","tags":["x_refsource_MISC"]},{"url":"http://www.osvdb.org/78276","tags":["vdb-entry","x_refsource_OSVDB"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":["<2.3.18"],"patched":["2.3.18"],"from":["GHSA-hmvj-gc9q-mg9p"],"provenance":"source"}],"advisories":[{"id":"GHSA-hmvj-gc9q-mg9p","url":"https://github.com/advisories/GHSA-hmvj-gc9q-mg9p","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":["<2.3.18"],"patched":["2.3.18"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-4179","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4179","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":18329,"url":"https://www.exploit-db.com/exploits/18329","title":"Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities","type":"webapps","platform":"multiple","date":"2012-01-06","verified":true,"provenance":"source"},{"id":31434,"url":"https://www.exploit-db.com/exploits/31434","title":"Apache Struts - Developer Mode OGNL Execution (Metasploit)","type":"remote","platform":"java","date":"2014-02-05","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2012-01-06"},"metasploit":[{"name":"Apache Struts 2 Developer Mode OGNL Execution","module":"exploit/multi/http/struts_dev_mode","type":"exploit","disclosureDate":"2012-01-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dev_mode.rb"}],"nuclei":[{"id":"CVE-2012-0394","name":"Apache Struts <2.3.1.1 - Remote Code Execution","severity":"medium","path":"http/cves/2012/CVE-2012-0394.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0394.yaml"}],"first":{"date":"2012-01-06","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/18329"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/18329","http://www.exploit-db.com/exploits/31434"],"flow":[],"timeline":[{"date":"2012-01-06","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-18329); later: Metasploit 2012-01-06","url":"https://www.exploit-db.com/exploits/18329","provenance":"source"},{"date":"2012-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2012-0394","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9945"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-org-apache-struts-struts2-core-cve-2012-0393","children":[{"from":"CVE-2012-0394","to":"CVE-2012-4387","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java"],"commits":["https://github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d","https://github.com/apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9","https://github.com/apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa"],"basis":"shared function","functions":["ParametersInterceptor","setDevMode"]}]},{"from":"CVE-2012-0394","to":"CVE-2014-0094","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java","xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java"],"commits":["https://github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d","https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f","https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62"],"basis":"shared function","functions":["CookieInterceptor","ParametersInterceptor","getExcludeParamsSet","intercept"]}]},{"from":"CVE-2012-0394","to":"CVE-2014-0116","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java"],"commits":["https://github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d","https://github.com/apache/struts/commit/1a668af7f1ffccea4a3b46d8d8c1fe1c7331ff02"],"basis":"shared function","functions":["CookieInterceptor","intercept"]}]}]}}