{"action":"Upgrade org.apache.struts.xwork:xwork-core to 2.2.3.1 or later.","affected":[{"fixed":"2.2.3.1","introduced":"0"}],"component":"org.apache.struts.xwork:xwork-core","cve_ids":["CVE-2012-0393"],"ecosystem":"Maven","epss":0.36319,"exploited":false,"fixed_versions":["2.2.3.1"],"ghsa_id":"GHSA-hxqq-w4mr-mc62","id":"tcs_01M5N91NR7EFSADMC0F86HZGD8","modified_at":"2024-12-03T06:02:47.456094Z","published_at":"2022-05-04T00:29:43Z","references":["https://osv.dev/vulnerability/GHSA-hxqq-w4mr-mc62","https://nvd.nist.gov/vuln/detail/CVE-2012-0393","https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","https://github.com/apache/struts/commit/9cad25f258bb2629d263f828574d2671366c238d","https://github.com/apache/struts","https://web.archive.org/web/20120612142634/https://sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","https://web.archive.org/web/20140723153720/http://secunia.com/advisories/47393","http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","http://struts.apache.org/2.x/docs/s2-008.html","http://struts.apache.org/2.x/docs/version-notes-2311.html","http://www.exploit-db.com/exploits/18329"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hxqq-w4mr-mc62#Maven/org.apache.struts.xwork:xwork-core","url":"https://osv.dev/vulnerability/GHSA-hxqq-w4mr-mc62"}],"summary":"Apache Struts's ParameterInterceptor component does not prevent access to public constructors"}