CVE-2012-0391

CWE-94

Critical

103.6

RPS

Description

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

Source: NVD

CVSS: 9.8; Critical · v3.1
EPSS: 75.59%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Jan 2022
Fix commit: Fix commit known; Sources: MoreFixes, FreshFixes
Weakness: CWE-94
Published: 8 Jan 2012; Last modified 22 Apr 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2012-0391

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 8 Oct 2026, 05:16 UK time

CVE-2012-0391

Description

Signals

Get this score from the API