VulnerabilityModified
CVE-2011-3923
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CRITICAL 9.8EPSS 89.5%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 89.5%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 89.49% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- apache/struts · redhat/jboss enterprise web server
- Source
- chrome-cve-admin@google.com
References
- http://seclists.org/fulldisclosure/2014/Jul/38
- http://www.exploit-db.com/exploits/24874
- http://www.securityfocus.com/bid/51628
- http://www.securitytracker.com/id?1026575
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72585
- https://security-tracker.debian.org/tracker/CVE-2011-3923
- http://seclists.org/fulldisclosure/2014/Jul/38
- http://www.exploit-db.com/exploits/24874
- http://www.securityfocus.com/bid/51628
- http://www.securitytracker.com/id?1026575
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72585
- https://security-tracker.debian.org/tracker/CVE-2011-3923
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.