CVE-2011-3923: Apache Struts ParameterInterceptor security bypass enables command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required and an EPSS near the top percentile, though the record does not confirm active exploitation.

What it is

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. The flaw is a permission-assignment weakness (CWE-732) in a core request-handling component, so any exposed Struts application on an affected version is at risk. It matters because successful exploitation yields full command execution on the server.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the application server, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network through HTTP requests to a Struts application; the CVSS vector shows no privileges and no user interaction required. No specific endpoint or parameter is named in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.89492, 99.8th percentile) and public references include an Exploit-DB entry, indicating mature public exploit code exists.

What to do

• Upgrade Apache Struts to 2.3.1.2 or later; this is the only definitive fix.
• If immediate upgrade is impossible, restrict network access to Struts endpoints to trusted sources and place them behind authentication where feasible.
• Review and harden ParameterInterceptor configuration and any exposed OGNL/parameter handling paths.
• Inventory applications and embedded servers (including JBoss Enterprise Web Server deployments) still running pre-2.3.1.2 Struts.
• Monitor vendor advisories for Red Hat and Debian packages and apply their backported fixes.

Detection

• Inspect web and application logs for suspicious parameter names or OGNL-style expressions in requests to Struts endpoints.
• Alert on unexpected child processes spawned by the Java application server (for example shell or command interpreters).
• Monitor outbound network connections from application servers for signs of post-exploitation command-and-control.
• Use file integrity monitoring on web application directories and deployed WAR files for unexpected changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.