CVE-2012-0391VulnerabilityPublished 01/21/2022Updated 10/24/2026

CVE-2012-0391: Apache Struts 2 Improper Input Validation Vulnerability

Affects Apache Struts 2Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/21/2022
KEV deadline: 07/21/2022
EPSS: 75.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2012-0391 (opens in a new tab)

Affected software

Product	Affected	Fixed in
Apache Struts 2	Affected <2.2.3.1	Fixed in–

Description

CVE-2012-0391 is a high severity vulnerability in Apache Struts 2 prior to version 2.2.3.1. It involves improper input validation in the ExceptionDelegator component, which can be exploited remotely to execute arbitrary code. This vulnerability has been exploited in the wild.

Summary

The ExceptionDelegator component in Apache Struts 2 versions before 2.2.3.1 suffers from improper input validation. This flaw allows attackers to remotely execute arbitrary code on affected systems. The vulnerability is identified as CWE-20 (Improper Input Validation) and has been observed in active exploitation scenarios.

Impact

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary commands or code on the affected server. This can result in full system compromise, data theft, or service disruption.

Mitigation

Upgrade Apache Struts 2 to version 2.2.3.1 or later, where this vulnerability is fixed. Since no patch links are provided, users should consult the official Apache Struts security advisories to obtain the appropriate fixed version. No other mitigations are specified.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 10:10:25 UTC

Weaknesses

References

Related threats