CVE-2012-0394 Public exploit EPSS 72.9%

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote…

Summary

The DebuggingInterceptor component in Apache Struts, before version 2.3.1.1, contains a flaw that is reachable when developer mode is enabled. An attacker can execute arbitrary commands via unspecified vectors, and the conditions required (such as network access or authentication) are not specified.

Official description · CVE.org

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 2 days before disclosure.

Public exploit codeExploit-DB6 Jan 20122 days before
Disclosed8 Jan 2012day 0

See the family tree

A fix was bypassed or incomplete 3 times over 4 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2012-0393The ParameterInterceptor component in Apache Struts before…8 Jan 2012
same family
This CVECVE-2012-0394The DebuggingInterceptor component in Apache Struts before…8 Jan 2012
relatedMedium
Why these are linked:
- Same code patched: ParametersInterceptor.java (machine-matched)Functions: ParametersInterceptor, setDevModecommit 9cad25f commit 80e0318 commit 87935af
CVE-2012-4387Struts 2.0.0 through 2.3.4 allows remote attackers to cause a…5 Sep 2012
relatedMedium
Why these are linked:
- Same code patched: ParametersInterceptor.java (machine-matched)Functions: ParametersInterceptorcommit 80e0318 commit 87935af commit 2e2da29 commit 6315241
CVE-2014-0094The ParametersInterceptor in Apache Struts before 2.3.16.2…10 Mar 2014
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not…29 Apr 2014
same family
CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a…29 Apr 2014
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…8 May 2014
same family
CVE-2015-1831The default exclude patterns (excludeParams) in Apache Struts…16 Jul 2015

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts.xwork:xwork-core.

Mavenorg.apache.struts.xwork:xwork-coreGHSA-hmvj-gc9q-mg9p

Upgrade to 2.3.18

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2012-0391, CVE-2012-0392, +4).

Still affected on this line by CVE-2025-68493 (fixed in 6.1.1, a newer line).

Set the version to 2.3.18 or later in your pom.xml or build.gradle.

The first fix for CVE-2012-0394.

Affected versions

If you run	Upgrade to
All versions before 2.3.18	2.3.18

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

7 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4179

Apache Struts 2 < 2.3.1 - Multiple VulnerabilitiesEDB-18329 · webapps · multiple · 2012-01-06 · verified
Apache Struts - Developer Mode OGNL Execution (Metasploit)EDB-31434 · remote · java · 2014-02-05 · verified

, 30 Oct 2026

72.9%Top 0.55%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.45%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9945 19.9/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 8 Jan 2012
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_MISC 3

exploit 2

mailing-list 1

vdb-entry 1

techniques