CVE-2012-0392 in Apache Struts
요약 (영어)
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
예약하다
2012. 01. 08.
공개
2012. 01. 08.
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 4512 | Apache Struts CookieInterceptor 권한 상승 | 264 | 개념 증명 | 공식 수정 | CVE-2012-0392 |