VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2012-1592

8.8 High Mitigation candidate

Description

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

CWE-434 · Unrestricted file upload

Exploitation Status

Working exploit published

A reviewed exploit catalogue carries this CVE. Somebody has published code a stranger can run.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2012-03-23.
  • EPSS 29% chance in 30 days A model prediction, not an observation. Higher than 98% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB Apache Struts 2.0 - 'XSLTResult.java' Arbitrary File Upload 2012-03-23

Waratek Defense Posture

Mitigation candidate

A defect of the type ARMR addresses, with a fix path to work from and a working exploit already published. This is a claim on attention, not a scheduling commitment: no rule exists and none is scheduled.

  • Protection none
  • Action unverified patch rule
  • Review automated inferred
  • Record active
Decided by patch-hint : A reference pointing at the upstream fix: a commit, a PR, a Red Hat bug
Finding A reference points at an upstream fix (redhat-cve tier): https://access.redhat.com/security/cve/cve-2012-1592. That makes this CVE a candidate for an ARMR patch rule — it is the kind of defect ARMR can address, and there is a fix to work from. No rule exists and none is scheduled: writing one means reading the linked change and finding a hook point ARMR can express it at, which may turn out not to exist.
Candidate fix https://access.redhat.com/security/cve/cve-2012-1592 : a Red Hat CVE page: the weakest tier, pinning no commit, but its existence means Red Hat triaged and shipped the CVE

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.5 no band published AV:N/AC:L/Au:S/C:P/I:P/A:P NVD Primary

Affected Software & Releases

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
org.apache.struts:struts2-core 2.0 2.5.22 unbounded

🖥️ Product CPEs & Version Ranges

2 product(s) over 2 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd apache struts generic 2.0.0
osv org.apache.struts struts2-core generic ≥ 2.0 and ＜ 2.5.22

References

URLTags
https://access.redhat.com/security/cve/cve-2012-1592 redhat-cve
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592 WEB
https://github.com/apache/struts PACKAGE
https://github.com/apache/struts/blob/master/core/src/main/resources/struts-default.xml#L39-L76 WEB
https://issues.apache.org/jira/browse/WW-5055 WEB
https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E WEB
https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2@%3Cissues.struts.apache.org%3E WEB
https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E WEB
https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc@%3Cissues.struts.apache.org%3E WEB
https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E WEB

Timeline

Published 2019-12-05 Last modified 2026-06-16
Published2019-12-05By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.