CVE-2014-0094 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 99.6% (pctl 100)
Patch early
A public exploit exists.
Description
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| EPSS | 99.57% — more likely to be exploited than 100% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-03-11 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | struts |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit) | 2014-05-02 |
| exploit-db | Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit) | 2014-03-06 |
References
- http://jvn.jp/en/jp/JVN19294237/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- http://secunia.com/advisories/56440
- http://secunia.com/advisories/59178
- http://struts.apache.org/release/2.3.x/docs/s2-020.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.securityfocus.com/archive/1/531362/100/0/threaded
- http://www.securityfocus.com/archive/1/532549/100/0/threaded
- http://www.securityfocus.com/bid/65999
- http://www.securitytracker.com/id/1029876
- http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- http://jvn.jp/en/jp/JVN19294237/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- http://secunia.com/advisories/56440
- http://secunia.com/advisories/59178
→ the Explorer · watch your stack · NVD