Overview
- Description
- The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 9.3
- Impact score
- 10
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:C/I:C/A:C
Known exploits
Data from CISA
- Vulnerability name
- Apache Struts 2 Improper Input Validation Vulnerability
- Exploit added on
- Jan 21, 2022
- Exploit action due
- Jul 21, 2022
- Required action
- Apply updates per vendor instructions.
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03A3B36D-229B-41BB-B201-CEB4464511EE",
"versionEndExcluding": "2.2.3.1",
"versionStartIncluding": "2.0.0"
}
],
"operator": "OR"
}
]
}
]