CVE-2014-0112

Published: Apr 29, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Affected (1)

Products: Apache: Struts

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	From 2.0.0 to 2.3.16.2

Related CWEs

References (28)

http://jvn.jp/en/jp/JVN19294237/index.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://secunia.com/advisories/59178

Source: secalert@redhat.com

Permissions Required

http://secunia.com/advisories/59500

Source: secalert@redhat.com

Permissions Required

http://www-01.ibm.com/support/docview.wss?uid=swg21676706

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/531952/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/532549/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/67064

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2014-0007.html

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0910

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1091939

Source: secalert@redhat.com

Issue Tracking

https://cwiki.apache.org/confluence/display/WW/S2-021

Source: secalert@redhat.com

PatchVendor Advisory

http://jvn.jp/en/jp/JVN19294237/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://secunia.com/advisories/59178

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

http://secunia.com/advisories/59500

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

http://www-01.ibm.com/support/docview.wss?uid=swg21676706

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/archive/1/531952/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/532549/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/67064

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2014-0007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0910

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1091939

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://cwiki.apache.org/confluence/display/WW/S2-021

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.