GitHub Advisoryadvisory · Maven

GHSA-3c5c-xrq4-qhr8 ClassLoader manipulation in Apache Struts

HIGH Published 2022-05-14 Modified 2022-11-03 Official page ↗
Aliases
CVE-2014-0113
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
High
Reviewed
2022-11-03

Affected packages

• Maven org.apache.struts:struts2-core: < 2.3.20 → fixed in 2.3.20

Description

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Related

Alias · CVE (1)

  • CVE-2014-0113 CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the… vulnerability

References