CVE-2012-0394

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

• CWE-94

• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/31434Exploit, Third Party Advisory, VDB Entry
• http://www.osvdb.org/78276Broken Link
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link
• http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
• http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
• http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
• http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/31434Exploit, Third Party Advisory, VDB Entry
• http://www.osvdb.org/78276Broken Link
• https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link

Published

Jan 8, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0388Memory leak in the H.323 inspection feature in the Zone-Base…
• CVE-2012-0389Cross-site scripting (XSS) vulnerability in ForgottenPasswor…
• CVE-2012-0390The DTLS implementation in GnuTLS 3.0.10 and earlier execute…
• CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2…9.8
• CVE-2012-0392The CookieInterceptor component in Apache Struts before 2.3.…
• CVE-2012-0393The ParameterInterceptor component in Apache Struts before 2…
• CVE-2012-0395Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6…
• CVE-2012-0396EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not …
• CVE-2012-0397Buffer overflow in EMC RSA SecurID Software Token Converter …
• CVE-2012-0398EMC Documentum eRoom before 7.4.4 does not properly validate…
• CVE-2012-0399Multiple cross-site scripting (XSS) vulnerabilities in EMC R…
• CVE-2012-0400EMC RSA enVision 4.x before 4.1 Patch 4 does not properly re…