CVE-2012-1592 in the critical feed json
Unrestricted Upload of File with Dangerous Type in Apache Struts2
published 2019-12-05 6 y ago modified 2026-06-16 4 mo ago also GHSA-8m5q-crqq-6pmf , EUVD-2022-1679
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 28.5%
- EPSS 28.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Patch / fix
- maven org.apache.struts:struts2-core 2.5.22
Timeline
- First public exploit (EDB-37009)
- Published
Exploit prediction
28.55% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-37009 Apache Struts 2.0 - 'XSLTResult.java' Arbitrary File Upload webapps, 2012-03-23
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >=2.0, <2.5.22 |
2.5.22 |
Affected products
- libstruts1.2-java libstruts1.2-java
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
security-tracker.debian.org
/tracker/CVE-2012-1592
web, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=CVE-2012-1592
web, issue-tracking, third-party-advisory
-
access.redhat.com
/security/cve/cve-2012-1592
web, third-party-advisory
-
openwall.com
/lists/oss-security/2012/03/28/12
mailing-list, third-party-advisory
-
lists.apache.org
/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2012-1592
advisory
-
github.com
/apache/struts
package
-
github.com
/apache/struts/blob/master/core/src/main/resources/struts-default.xml#L39-L76
web
-
issues.apache.org
/jira/browse/WW-5055
web
-
lists.apache.org
/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2@%3Cissues.struts.apache.org%3E
web
-
lists.apache.org
/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc@%3Cissues.struts.apache.org%3E
web
-
lists.apache.org
/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b@%3Cissues.struts.apache.org%3E
web
-
seclists.org
/bugtraq/2012/Mar/110
web
-
struts.apache.org
/security/#internal-security-mechanism
web
-
openwall.com
/lists/oss-security/2012/03/28/12
web
Sources
- CVE List CVE-2012-1592
- GitHub Advisory GHSA-8m5q-crqq-6pmf
- NVD CVE-2012-1592
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.