K13434228: Apache Struts vulnerability CVE-2012-0392

Security Advisory Description The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...

SUSE CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +81 more potentially affected by CVE-2012-0392 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.1.1 and more Source cves: CVE-2012-0392 Source advisory: OSV:GHSA-2PPP-XJ34-VVF7...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +63 more potentially affected by CVE-2012-0392 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0-rc2, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 5.0.1.1 and more Source cves: CVE-2012-0392 Source advisory: GHSA-2PPP-XJ34-VVF7...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +63 more potentially affected by CVE-2012-0392 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0-rc2, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 5.0.1.1 and more Source cves: CVE-2012-0392 Source advisory: OSV:GHSA-2PPP-XJ34-VVF7...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +81 more potentially affected by CVE-2012-0392 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.1.1 and more Source cves: CVE-2012-0392 Source advisory: GHSA-2PPP-XJ34-VVF7...

Apache Struts 2 CookieInterceptor OGNL Script Injection (CVE-2012-0392)

A code execution vulnerability has been reported in Apache Struts 2...

CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...

CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...

CVE-2012-0392

CVE-2012-0392 affects Apache Struts: CookieInterceptor does not enforce a parameter-name whitelist, enabling remote code execution via a crafted HTTP Cookie header that can trigger Java code execution through a static method. The Nuclei template confirms this as part of the S2-008 family, describ...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +81 more potentially affected by CVE-2012-0392 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.1.1 and more Source cves: CVE-2012-0392 Source advisory: MEND:CVE-2012-0392...