CVE-2012-1592

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
libstruts1.2-java	libstruts1.2-java	1.2-

References

http://www.openwall.com/lists/oss-security/2012/03/28/12Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-1592Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E
https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2012-1592Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/03/28/12Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-1592Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E
https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2012-1592Third Party Advisory

Timeline

Published: Dec 5, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-15933.3epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to c CVE-2012-15943.3epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of CVE-2012-15954.3The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attac CVE-2012-15965.0The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6 CVE-2012-15972.6Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 a CVE-2012-15987.5Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerabili CVE-2012-15995.0Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end informa CVE-2012-16004.3Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary w CVE-2012-16014.9The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host CVE-2012-16027.5user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1.CVE-2012-16037.5Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1)CVE-2012-16044.3Cross-site scripting (XSS) vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter