CveMateVulnerability intelligence

CVE-2014-0094: apache struts

CVSS: 5.0v2.0MediumModified

AliasesGHSA-vrwc-qjmw-5rjm

Published 10-03-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-0094 is a medium (CVSS 5.0) vulnerability in apache struts. EPSS estimates a 99.39% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

50/100

0100

High · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

99.39%

0%100%

Critical · -0.14 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Timeline

10-03-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

99.39%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.14 pp

From 99.52% on 18-09-2026

18-09-202618-10-2026

EPSS score

99.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaseremotemultipleVerified
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
Maturity: weaponized
exploit-databaseremotemultipleVerified
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)
Maturity: weaponized
MetasploitremoteUnverified
Apache Struts ClassLoader Manipulation Remote Code Execution
exploit/multi/http/struts_code_exec_classloader
Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Apache1 product

struts≥ 2.0.0, < 2.3.16.1

Org.apache.struts1 product

struts2-core≥ 2.0.0, < 2.3.16.2

Org.apache.struts.xwork1 product

xwork-core≥ 2.0.0, < 2.3.16.2

3 vendors · 3 products

References

19 links

packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlX Refsource MISCThird Party AdvisoryVDB EntryWEB
secunia.com/advisories/59178Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.vmware.com/security/advisories/VMSA-2014-0007.htmlX Refsource CONFIRMThird Party AdvisoryWEB
www.konakart.com/downloads/ver-7-3-0-0-whats-newX Refsource CONFIRMThird Party AdvisoryWEB
www.securityfocus.com/archive/1/531362/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlX Refsource CONFIRMThird Party Advisory
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htmX Refsource CONFIRMThird Party AdvisoryWEB
jvn.jp/en/jp/JVN19294237/index.htmlThird Party AdvisoryX Refsource JVNVDB EntryWEB
struts.apache.org/release/2.3.x/docs/s2-020.htmlX Refsource CONFIRMVendor AdvisoryWEB
jvndb.jvn.jp/jvndb/JVNDB-2014-000045Third Party AdvisoryX Refsource JVNDBVDB EntryWEB

Show all 19 references

www-01.ibm.com/support/docview.wss?uid=swg21676706X Refsource CONFIRMThird Party AdvisoryWEB
secunia.com/advisories/56440Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id/1029876VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/archive/1/532549/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/65999VDB EntryX Refsource BIDThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2014-0094Advisory
github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3fWEB
github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62WEB
github.com/apache/strutsPACKAGE