{"id":"CVE-2012-0392","description":"The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.","cvssScore":6.8,"cvssVersion":"2.0","cvssVector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","cvssMetrics":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"MITIGATION-CANDIDATE","published":"2012-01-08","lastModified":"2026-06-16","affectedProducts":[{"vendor":"apache","product":"struts","versionStart":"\u003e=2.0.0","versionEnd":"\u003c2.3.1"}],"totalAffectedProducts":1,"references":[{"url":"https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","source":"osv","tags":["WEB"]},{"url":"https://github.com/apache/struts","source":"osv","tags":["PACKAGE"]},{"url":"https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.html","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20120612142634/https://sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20140723153720/http://secunia.com/advisories/47393","source":"osv","tags":["WEB"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html","source":"osv","tags":["WEB"]},{"url":"http://struts.apache.org/2.x/docs/s2-008.html","source":"osv","tags":["WEB"]},{"url":"http://struts.apache.org/2.x/docs/version-notes-2311.html","source":"osv","tags":["WEB"]},{"url":"http://www.exploit-db.com/exploits/18329","source":"osv","tags":["WEB"]},{"url":"http://secunia.com/advisories/47393","source":"cve@mitre.org","tags":["Third Party Advisory"]}],"reasoning":{"decidingSource":"open-source-maven","decidingReason":"This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written.","decisive":true},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"no-match"},{"rule":"below-action-threshold","stage":"disposition","outcome":"withheld","detail":"Has 2 known POC(s) clearing the evidence bar — requires review despite MEDIUM severity"},{"rule":"no-exploit-published","stage":"disposition","outcome":"no-match","detail":"A KEV listing, a CISA verdict of active exploitation, or a reviewed exploit catalogue carries this CVE — somebody has published a working exploit, so it stays a candidate"}],"affectedProducts":[{"vendor":"apache","product":"struts","isKnown":true,"cpe":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","source":"yaml"}],"affectedPackages":[{"name":"org.apache.struts:struts2-core","introduced":"0","fixed":"2.2.3.1"},{"name":"org.apache.struts.xwork:xwork-core","introduced":"0","fixed":"2.2.3.1"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"none"},"action":{"state":"unverified","type":"patch-rule"},"review":{"state":"automated","basis":"inferred"}},"exploits":[{"source":"exploit-db","url":"https://www.exploit-db.com/exploits/18329","title":"Apache Struts 2 \u003c 2.3.1 - Multiple Vulnerabilities","date":"2012-01-06"},{"source":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0392.yaml","title":"Apache Struts2 S2-008 RCE"}],"signals":{"hasPOC":true,"pocCount":2,"pocSources":["exploit-db","nuclei"],"firstPOCDate":"2012-01-06"},"kev":{"inKEV":false},"epss":{"available":true,"score":0.97534,"percentile":0.99898},"ssvc":{"available":false}}