Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Published

2014-04-30T10:49:03.973

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache commons_beanutils ≤ 1.9.1 Yes
Application apache struts 1.0 Yes
Application apache struts 1.0.2 Yes
Application apache struts 1.1 Yes
Application apache struts 1.1 Yes
Application apache struts 1.1 Yes
Application apache struts 1.1 Yes
Application apache struts 1.1 Yes
Application apache struts 1.1 Yes
Application apache struts 1.2.2 Yes
Application apache struts 1.2.4 Yes
Application apache struts 1.2.6 Yes
Application apache struts 1.2.7 Yes
Application apache struts 1.2.8 Yes
Application apache struts 1.2.9 Yes
Application apache struts 1.3.5 Yes
Application apache struts 1.3.8 Yes
Application apache struts 1.3.10 Yes
References