ID:4946 - Exploit for Code Injection in Apache Struts - CVE-2012-0392

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Exploits ID:4946 - Exploit for Code Injection in Apache Struts - CVE-2012-0392

ID:4946 - Exploit for Code Injection in Apache Struts - CVE-2012-0392

Published: December 17, 2020


Vulnerability identifier: #VU49061
Vulnerability risk: High
CVE-ID: CVE-2012-0392
CWE-ID: CWE-94
Exploitation vector: Remote access
Vulnerable software:
Apache Struts

Link to public exploit:


Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper access restrictions within the CookieInterceptor component in Apache Struts. A remote attacker can send a specially crafted HTTP Cookie header that triggers Java code execution through a static method and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.