{"action":"Upgrade org.apache.struts.xwork:xwork-core to 2.3.18 or later.","affected":[{"fixed":"2.3.18","introduced":"0"}],"component":"org.apache.struts.xwork:xwork-core","cve_ids":["CVE-2012-0394"],"ecosystem":"Maven","epss":0.729,"exploited":false,"fixed_versions":["2.3.18"],"ghsa_id":"GHSA-hmvj-gc9q-mg9p","id":"tcs_01M5N90ZMYBWB22KQ4662JMMAY","modified_at":"2024-12-03T06:05:17.910072Z","published_at":"2022-05-04T00:29:43Z","references":["https://osv.dev/vulnerability/GHSA-hmvj-gc9q-mg9p","https://nvd.nist.gov/vuln/detail/CVE-2012-0394","https://github.com/apache/struts/commit/34c80dae734e70f13c0e46f9c83602fb71318e58","https://github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d","https://github.com/apache/struts","https://issues.apache.org/jira/browse/WW-3729","https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","http://struts.apache.org/2.x/docs/s2-008.html","http://struts.apache.org/2.x/docs/version-notes-2311.html","http://www.exploit-db.com/exploits/18329","http://www.exploit-db.com/exploits/31434"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hmvj-gc9q-mg9p","url":"https://osv.dev/vulnerability/GHSA-hmvj-gc9q-mg9p"}],"summary":"Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode"}