CVE-2014-0114

Aliases:GHSA-p66x-2cv9-qq3v
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 30 Apr 2014, 10:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
high
58/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
92.33% CRITICAL
92% probability -0.41%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

30 Apr 2014, 10:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

CVSS Metrics

  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 92.33%• Percentile: 100%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

  • apache•commons_beanutils

    ≤ 1.9.1

  • Unknown•Struts

    1.0 | 1.0.2 | 1.1 | 1.1:b1 | 1.1:b2 | 1.1:b3 | 1.1:rc1 | 1.1:rc2 | 1.2.2 | 1.2.4 | 1.2.6 | 1.2.7 | 1.2.8 | 1.2.9 | 1.3.5 | 1.3.8 | 1.3.10

  • commons-beanutils•commons-beanutils

    ≥ 1.8.0, < 1.9.4

References (176)