peter bassill · operator
$ cve CVE-2014-0114 JSON

CVE-2014-0114 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 99% (pctl 100)

Patch early

A public exploit exists.

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS98.95% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-20
On CISA KEVno
Public exploityes
Published2014-04-30
Last modified2026-06-17

Affected (2)

VendorProduct
apachecommons beanutils
apachestruts

Public exploits

SourceTitleDate
exploit-dbApache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)2014-03-06

References

→ the Explorer  ·  watch your stack  ·  NVD