CVE-2014-0094

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

99.39% chance of exploitation in the next 30 days, 100th percentile

Published

2014-03-10

Updated

2024-08-06

Proof-of-concept exploits (2)

• HasegawaTadamitsu/CVE-2014-0094-test-program-for-struts11★ · 2017-12-24
• y0d3n/CVE-2014-00941★ · 2023-06-15

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_clas…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/41690
• https://www.exploit-db.com/exploits/33142

Security advisories

• http://secunia.com/advisories/56440
• http://struts.apache.org/release/2.3.x/docs/s2-020.html
• http://jvn.jp/en/jp/JVN19294237/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
• http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
• http://www-01.ibm.com/support/docview.wss?uid=swg21676706
• http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733…
• http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
• http://www.securityfocus.com/archive/1/531362/100/0/threaded
• http://www.securityfocus.com/archive/1/532549/100/0/threaded
• http://www.securityfocus.com/bid/65999
• http://www.securitytracker.com/id/1029876
• http://www.vmware.com/security/advisories/VMSA-2014-0007.html
• advisories/GHSA-vrwc-qjmw-5rjm

References

• CVE Record
• NVD entry