K34352169: Apache Struts vulnerability CVE-2012-0393

Security Advisory Description The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. CVE-2012-0393...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +63 more potentially affected by CVE-2012-0393 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0-rc2, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 5.0.1.1 and more Source cves: CVE-2012-0393 Source advisory: OSV:GHSA-HXQQ-W4MR-MC62...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +125 more potentially affected by CVE-2012-0393 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.2.0, =1.0.3, =0.6, =3.0-rc2, =5.0.1 - com.google.inject.extensions:guice-struts2-plugin 2.0 - com.google.inject.integration:guice-struts2-plugin 1.0 - com.googlecode.rapid-framework:rapid-core 4.0 and more Source cves:...

CVE-2012-0393

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +63 more potentially affected by CVE-2012-0393 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0-rc2, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 5.0.1.1 and more Source cves: CVE-2012-0393 Source advisory: MEND:CVE-2012-0393...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +125 more potentially affected by CVE-2012-0393 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.2.0, =1.0.3, =0.6, =3.0-rc2, =5.0.1 - com.google.inject.extensions:guice-struts2-plugin 2.0 - com.google.inject.integration:guice-struts2-plugin 1.0 - com.googlecode.rapid-framework:rapid-core 4.0 and more Source cves:...

CVE-2012-0393

CVE-2012-0393 concerns Apache Struts 2.x. The vulnerability lies in the ParameterInterceptor component not preventing access to public constructors, allowing a remote attacker to cause the creation of Java objects and thus “trigger” the creation or overwrite of arbitrary files via a crafted param...

CVE-2012-0393

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object...