CVE-2014-0112

CVE Database · CVE-2014-0112

CVE-2014-0112

· N/AModified

CVSS v3.1

N/A

EPSS

97.91%

Published

Apr 29, 2014

Modified

May 6, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBApache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)Exploit-DBApache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Weaknesses (CWE)

CWE-264

Affected Products (1)

apache · struts (up to 2.3.16.2)vulnerable

References (20)

http://jvn.jp/en/jp/JVN19294237/index.html

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

Third Party AdvisoryVDB Entry

http://secunia.com/advisories/59178

Permissions Required

http://secunia.com/advisories/59500

Permissions Required

http://www-01.ibm.com/support/docview.wss?uid=swg21676706

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs