CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
• http://secunia.com/advisories/47393Third Party Advisory
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
• https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.htmlExploit, Third Party Advisory
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
• http://secunia.com/advisories/47393Third Party Advisory
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
• https://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.htmlExploit, Third Party Advisory
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link

Published

Jan 8, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0386The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1…
• CVE-2012-0387Memory leak in the HTTP Inspection Engine feature in the Zon…
• CVE-2012-0388Memory leak in the H.323 inspection feature in the Zone-Base…
• CVE-2012-0389Cross-site scripting (XSS) vulnerability in ForgottenPasswor…
• CVE-2012-0390The DTLS implementation in GnuTLS 3.0.10 and earlier execute…
• CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2…9.8
• CVE-2012-0393The ParameterInterceptor component in Apache Struts before 2…
• CVE-2012-0394The DebuggingInterceptor component in Apache Struts before 2…
• CVE-2012-0395Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6…
• CVE-2012-0396EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not …
• CVE-2012-0397Buffer overflow in EMC RSA SecurID Software Token Converter …
• CVE-2012-0398EMC Documentum eRoom before 7.4.4 does not properly validate…