CVE-2011-3923

CRITICAL

Apache Struts <2.3.1.2 - Command Injection

Title source: llm

Description

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/24874
metasploit WORKING POC EXCELLENT
by Meder Kydyraliev · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb

References (7)

Scores

CVSS v3 9.8
EPSS 0.9105
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (3)
apache/struts 2.0.0 - 2.3.1.2
org.apache.struts/struts2-core 2.0.0 - 2.3.1.2Maven
redhat/jboss_enterprise_web_server 1.0.0
Published Nov 01, 2019
Tracked Since Feb 18, 2026