CVE-2014-0113

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

• CWE-264

• http://secunia.com/advisories/59178Permissions Required
• http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
• https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory
• http://secunia.com/advisories/59178Permissions Required
• http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
• https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory

Published

Apr 29, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0107The TransformerFactory in Apache Xalan-Java before 2.7.2 doe…
• CVE-2014-0108Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0109Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0110Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0111Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 all…
• CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does no…
• CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-bean…
• CVE-2014-0115Directory traversal vulnerability in the log viewer in Apach…
• CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…
• CVE-2014-0117The mod_proxy module in the Apache HTTP Server 2.4.x before …
• CVE-2014-0118The deflate_in_filter function in mod_deflate.c in the mod_d…
• CVE-2014-0119Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x befo…