CVE-2011-3923: Remote Command Execution in org.apache.struts:struts2-core
Summary
CVE-2011-3923: Struts ParameterInterceptor vulnerability allows remote command execution. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.3.1.2. Fixed in 2.3.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.struts:struts2-core is a popular open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications. However, a vulnerability has been discovered in the ParametersInterceptor component of struts2-core, which allows remote command execution.
Vulnerability Detail
The vulnerability arises from a regular expression in the ParametersInterceptor that matches a specific pattern as a valid expression. This pattern can be manipulated by an attacker to inject arbitrary OGNL (Object-Graph Navigation Language) statements into any exposed String variable of an action. These OGNL statements are then evaluated by the OGNL library, allowing the execution of arbitrary methods. By using blacklisted characters, such as '#', an attacker can disable method execution and execute their own malicious code, bypassing the built-in protections of the ParametersInterceptor and OGNL library.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable the ParametersInterceptor component in the application's configuration. This can be achieved by modifying the struts.xml file and removing the interceptor reference for ParametersInterceptor. However, this workaround may impact the functionality of the application and should only be considered as a temporary solution until the package can be upgraded.
Conclusion
The ParametersInterceptor vulnerability in org.apache.struts:struts2-core exposes web applications to remote command execution. It is crucial to upgrade to the latest version of the package or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
org.apache.struts:struts2-core is an open-source framework for developing Java web applications. It provides a set of tools and libraries to simplify the development process and enhance the security of web applications.
OGNL (Object-Graph Navigation Language) is a powerful expression language used in the struts2-core framework for evaluating expressions and accessing object properties. It allows developers to manipulate and access objects in a flexible and dynamic manner.
The vulnerability arises from a regular expression in the ParametersInterceptor that matches a specific pattern as a valid expression. This pattern can be manipulated by an attacker to inject arbitrary OGNL statements into any exposed String variable of an action. These OGNL statements are then evaluated by the OGNL library, allowing the execution of arbitrary methods.
The vulnerability allows remote command execution, which means that an attacker can execute arbitrary code on the affected system. This can lead to various security risks, including unauthorized access, data leakage, and system compromise.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
