CVE-2012-0394
** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
Date published : 2012-01-08
http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html