Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

CVE-2011-3923

CRITICAL

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Published
Nov 1, 2019
Updated
Nov 21, 2024
Affected
0 pkgs
Patched
None yet
Exploits
4 known

EPSS Exploitation Probability

via FIRST.org ↗
91.1%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
89.2%90.0%90.8%91.6%89.7%91.1%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Affected Products

2 products · 2 configurations
Application
strutsapache
≥ 2.0.0 && < 2.3.1.2
range
Application
jboss enterprise web serverredhat
1 version
1.0.0
Exploits & PoCs
4

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-24874remotemultiple✓ Verified

Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)

by Metasploit · Mar 22, 2013

Frequently Asked Questions

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
O3 Security · Impact-Aware SCA

Is CVE-2011-3923 in your stack?

O3 detects CVE-2011-3923 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.