CVE-2012-0393

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

• CWE-264

• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlExploit, Third Party Advisory
• http://secunia.com/advisories/47393Third Party Advisory
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlVendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtExploit, Third Party Advisory
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlExploit, Third Party Advisory
• http://secunia.com/advisories/47393Third Party Advisory
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlVendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtExploit, Third Party Advisory

Published

Jan 8, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0387Memory leak in the HTTP Inspection Engine feature in the Zon…
• CVE-2012-0388Memory leak in the H.323 inspection feature in the Zone-Base…
• CVE-2012-0389Cross-site scripting (XSS) vulnerability in ForgottenPasswor…
• CVE-2012-0390The DTLS implementation in GnuTLS 3.0.10 and earlier execute…
• CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2…9.8
• CVE-2012-0392The CookieInterceptor component in Apache Struts before 2.3.…
• CVE-2012-0394The DebuggingInterceptor component in Apache Struts before 2…
• CVE-2012-0395Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6…
• CVE-2012-0396EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not …
• CVE-2012-0397Buffer overflow in EMC RSA SecurID Software Token Converter …
• CVE-2012-0398EMC Documentum eRoom before 7.4.4 does not properly validate…
• CVE-2012-0399Multiple cross-site scripting (XSS) vulnerabilities in EMC R…