CVE-2012-4386

Apache Struts 2.0.0-2.3.4 - Cross-Site Request Forgery via Token Name Parameter

Title source: llm
STIX 2.1

Description

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.

References (7)

Core 7
Core References
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/WW-3858
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78182
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/01/5
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50420
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55346
Vendor Advisory x_refsource_confirm
http://struts.apache.org/2.x/docs/s2-010.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/01/4

Scores

EPSS 0.0333
EPSS Percentile 87.2%

Details

CWE
CWE-352
Status published
Products (36)
apache/struts 2.0.0
apache/struts 2.0.1
apache/struts 2.0.2
apache/struts 2.0.3
apache/struts 2.0.4
apache/struts 2.0.5
apache/struts 2.0.6
apache/struts 2.0.7
apache/struts 2.0.8
apache/struts 2.0.9
... and 26 more
Published Sep 05, 2012
Tracked Since Feb 18, 2026