{"id":"CVE-2012-0838","published":"2012-03-02T22:00:00Z","modified":"2024-08-06T18:38:14Z","title":"Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.13687,"percentile":0.96478,"provenance":"source"},"cwes":[],"references":[{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012","tags":["third-party-advisory","x_refsource_JVNDB"]},{"url":"http://struts.apache.org/2.3.1.2/docs/s2-007.html","tags":["x_refsource_CONFIRM"]},{"url":"https://issues.apache.org/jira/browse/WW-3668","tags":["x_refsource_CONFIRM"]},{"url":"http://jvn.jp/en/jp/JVN79099262/index.html","tags":["third-party-advisory","x_refsource_JVN"]}],"priority":{"score":19.3,"factors":[{"name":"EPSS percentile","points":19.3}]},"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":["<2.2.3.1"],"patched":["2.2.3.1"],"from":["GHSA-mwrx-hx6x-3hhv"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":["<2.2.3.1"],"patched":["2.2.3.1"],"from":["GHSA-mwrx-hx6x-3hhv"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4641","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2011-1772","published":"2011-05-13","fixed":"2.2.3","kev":false,"link":{"from":"CVE-2011-1772","to":"CVE-2012-0838","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.2.3","toFixed":"2.2.3.1","daysApart":294}]}},{"cve":"CVE-2012-0391","published":"2012-01-08","fixed":"2.2.3.1","kev":true},{"cve":"CVE-2012-0392","published":"2012-01-08","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2012-0838","published":"2012-03-02","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2012-0393","published":"2012-01-08","fixed":"2.3.1.1","kev":false},{"cve":"CVE-2011-3923","published":"2019-11-01","fixed":"2.3.1.2","kev":false},{"cve":"CVE-2012-4386","published":"2012-09-05","fixed":"2.3.4.1","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}