2 matches found
CVE-2012-0392
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...
6.8CVSS7.3AI score0.98EPSS
SaveExploits2References3
Security feature bypass
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...
6.8CVSS8.4AI score0.98EPSS
SaveExploits2References7Affected Software1
20