CVE-2012-0838 Apache Struts Code injection due to conversion error

What is CVE-2012-0838?

CVE-2012-0838 is a critical code injection vulnerability in Apache Struts, published on 2 Mar 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

Weakness: CWE-20

Which versions are affected by CVE-2012-0838?

4 open source packages ship an affected version, including org.apache.struts.xwork:xwork-core and org.apache.struts:struts2-core. It affects 1 product.

Products include Apache Struts.

How do I fix CVE-2012-0838?

Upgrade org.apache.struts.xwork:xwork-core to 2.2.3.1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2012-0838 being exploited?

There is no known exploitation of CVE-2012-0838 in the wild and no public exploit code.

Other vulnerabilities in Apache Struts

• CVE-2020-17530 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2017-9791 Apache Struts 1 Improper Input Validation Exploited Critical 9.8
• CVE-2017-5638 Apache Struts Remote Code Execution Exploited Critical 9.8
• CVE-2012-0391 Apache Struts 2 Improper Input Validation Exploited Critical 9.8
• CVE-2018-11776 Apache Struts Remote Code Execution Exploited High 8.1

All Apache Struts vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mwrx-hx6x-3hhv.