CVE-2012-0392

Description

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

Primary references

• cve@mitre.org — Broken Link
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry