CVE-2012-0392 Public exploit EPSS 97.5%

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which…

Summary

The CookieInterceptor component in Apache Struts before 2.3.1.1 lacks the parameter-name whitelist that should restrict which parameters it processes.

Official description · CVE.org

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

Breakdown

25.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 2 days before disclosure.

Public exploit codeExploit-DB6 Jan 20122 days before
Disclosed8 Jan 2012day 0

7 fixes in struts2-core over 9 years. The latest fix listed for struts2-core is 2.3.1.2.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.2.1CVE-2010-187017 Aug 2010
2.2.3CVE-2011-177213 May 2011
2.2.3.1CVE-2012-03918 Jan 2012KEV
2.2.3.1CVE-2012-03928 Jan 2012
2.2.3.1CVE-2012-08382 Mar 2012
2.3.1.1CVE-2012-03938 Jan 2012
2.3.1.2CVE-2011-39231 Nov 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-2ppp-xj34-vvf7

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.2.3.1 for CVE-2012-0392.

Affected versions

If you run	Upgrade to
All versions before 2.2.3.1	2.5.33first fix for this CVE: 2.2.3.1

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Mavenorg.apache.struts.xwork:xwork-core
Affected: All versions before 2.2.3.1Upgrade to 2.3.18 or later
GHSA-2ppp-xj34-vvf7

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

7 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-2028

Apache Struts 2 < 2.3.1 - Multiple VulnerabilitiesEDB-18329 · webapps · multiple · 2012-01-06 · verified

, 30 Oct 2026

97.5%Top 0.1%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.9%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9990 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.0

Record

Published: 8 Jan 2012
Modified: 16 Sep 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

exploit 1

mailing-list 2

x_refsource_CONFIRM 2

x_refsource_MISC 1

third-party-advisory 1

techniques