CVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability
Published Jan 8, 2012 · updated Jun 16, 2026 · apache struts
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Timeline
Detection, updates, and resolution for this record.
Jan 8, 2012 · Catalog
Detected
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Jan 21, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jul 21, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Required action
Apply updates per vendor instructions.
CISA due date Jul 21, 2022
Affected
- cpe apache/strutsversion unspecified
- vendor Apache Struts 2version unspecified
Sources
- CISA KEVCVE-2012-0391
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
cisa.gov - CVE.orgCVE-2012-0391
Official CVE identifier
cve.org - FIRST EPSSCVE-2012-0391
30-day exploitation probability 75.6%
first.org - Exploit Database18329
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database18984
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/struts_code_exec_exception_delegator
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
nvd.nist.gov