GitHub Advisoryadvisory · Maven
GHSA-prjv-jj26-wf8h ClassLoader manipulation in Apache Struts
HIGH
Official page ↗
- Aliases
- CVE-2014-0112
- Ecosystem
- Maven
- Packages
- org.apache.struts:struts2-core
- Severity
- High
- Reviewed
- 2022-11-03
Affected packages
• Maven org.apache.struts:struts2-core: < 2.3.20 → fixed in 2.3.20
Description
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Related
Alias · CVE (1)
- CVE-2014-0112 ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-0112 advisory
- https://access.redhat.com/errata/RHSA-2019:0910 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1091939 web
- https://cwiki.apache.org/confluence/display/WW/S2-021 web
- https://github.com/apache/struts package
- http://jvn.jp/en/jp/JVN19294237/index.html web
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045 web
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html web
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706 web
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html web
- http://www.vmware.com/security/advisories/VMSA-2014-0007.html web