GitHub Advisoryadvisory · Maven
GHSA-vrwc-qjmw-5rjm ClassLoader manipulation in Apache Struts
MEDIUM
Official page ↗
- Aliases
- CVE-2014-0094
- Ecosystem
- Maven
- Packages
- org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core
- Severity
- Moderate
- Reviewed
- 2022-11-03
Affected packages
• Maven org.apache.struts:struts2-core: >= 2.0.0, < 2.3.16.2 → fixed in 2.3.16.2
• Maven org.apache.struts.xwork:xwork-core: >= 2.0.0, < 2.3.16.2 → fixed in 2.3.16.2
Description
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Related
Alias · CVE (1)
- CVE-2014-0094 The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter,… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-0094 advisory
- https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f web
- https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62 web
- https://github.com/apache/struts package
- http://jvn.jp/en/jp/JVN19294237/index.html web
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045 web
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html web
- http://struts.apache.org/release/2.3.x/docs/s2-020.html web
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706 web
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm web
- http://www.konakart.com/downloads/ver-7-3-0-0-whats-new web
- http://www.vmware.com/security/advisories/VMSA-2014-0007.html web