CVE-2014-0112

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

• CWE-264

• http://jvn.jp/en/jp/JVN19294237/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlThird Party Advisory, VDB Entry
• http://secunia.com/advisories/59178Permissions Required
• http://secunia.com/advisories/59500Permissions Required
• http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/532549/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/67064Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2014-0007.htmlThird Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0910Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1091939Issue Tracking
• https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory
• http://jvn.jp/en/jp/JVN19294237/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlThird Party Advisory, VDB Entry
• http://secunia.com/advisories/59178Permissions Required
• http://secunia.com/advisories/59500Permissions Required
• http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/532549/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/67064Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2014-0007.htmlThird Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0910Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1091939Issue Tracking
• https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory

Published

Apr 29, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0106Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does no…
• CVE-2014-0107The TransformerFactory in Apache Xalan-Java before 2.7.2 doe…
• CVE-2014-0108Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0109Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0110Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0111Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 all…
• CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a wil…
• CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-bean…
• CVE-2014-0115Directory traversal vulnerability in the log viewer in Apach…
• CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…
• CVE-2014-0117The mod_proxy module in the Apache HTTP Server 2.4.x before …
• CVE-2014-0118The deflate_in_filter function in mod_deflate.c in the mod_d…