CVE-2012-4387
Apache Struts 2.0.0-2.3.4 - Denial of Service via Long Parameter Name
Title source: llmDescription
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78183
Patch, Vendor Advisory x_refsource_confirm
http://struts.apache.org/2.x/docs/s2-011.html
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/01/5
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/50420
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/55346
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/WW-3860
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/01/4
Scores
EPSS
0.0835
EPSS Percentile
94.3%
Details
CWE
CWE-264
Status
published
Products (36)
apache/struts
2.0.0
apache/struts
2.0.1
apache/struts
2.0.2
apache/struts
2.0.3
apache/struts
2.0.4
apache/struts
2.0.5
apache/struts
2.0.6
apache/struts
2.0.7
apache/struts
2.0.8
apache/struts
2.0.9
... and 26 more
Published
Sep 05, 2012
Tracked Since
Feb 18, 2026