CVE-2012-0394

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/31434Exploit, Third Party Advisory, VDB Entry
http://www.osvdb.org/78276Broken Link
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.htmlBroken Link
http://struts.apache.org/2.x/docs/s2-008.htmlVendor Advisory
http://struts.apache.org/2.x/docs/version-notes-2311.htmlRelease Notes, Vendor Advisory
http://www.exploit-db.com/exploits/18329Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/31434Exploit, Third Party Advisory, VDB Entry
http://www.osvdb.org/78276Broken Link
https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txtBroken Link

Timeline

Published: Jan 8, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-03959.3Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to caus CVE-2012-03964.0EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote auth CVE-2012-03977.6Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly ex CVE-2012-03987.5EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via CVE-2012-03994.3Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary we CVE-2012-04007.9EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for r CVE-2012-04016.5Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL CVE-2012-04029.3EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access CVE-2012-04036.3Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact CVE-2012-04044.3Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows remote attackers to inject arbitrary web script or HTML CVE-2012-04067.8The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to ca CVE-2012-04075.0Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a de