Unscored severity · published Apr 30, 2014
CVE-2014-0114
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2,…
–
CVSS
99%
EPSS
No
On KEV
Description
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Exploitation
Is it being used?
Exploit prediction (EPSS)99.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
1.0; 1.0.2; 1.1; 1.1; 1.1; 1.1; +11 more · source: NVD
CB
Commons Beanutils · Apache
through 1.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0114
advisories.mageia.org
http://advisories.mageia.org/MGASA-2014-0219.html
apache-ignite-developers.2346864.n4.nabble.com
http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html
commons.apache.org
http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html
marc.info
http://marc.info/?l=bugtraq&m=140119284401582&w=2
marc.info
http://marc.info/?l=bugtraq&m=140801096002766&w=2
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…