Strix
26.1K

CVE-2014-0114

UnknownEPSS 95.82%

Last modified

CVE-2014-0114 is a vulnerability of currently unknown severity. Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.. EPSS estimates a 95.82% chance of exploitation in the next 30 days.

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Metrics

EPSS Probability
95.82%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheCommons Beanutils<= 1.9.1
ApacheStruts1.0
ApacheStruts1.0.2
ApacheStruts1.1
ApacheStruts1.2.2
ApacheStruts1.2.4
ApacheStruts1.2.6
ApacheStruts1.2.7
ApacheStruts1.2.8
ApacheStruts1.2.9
ApacheStruts1.3.5
ApacheStruts1.3.8
ApacheStruts1.3.10

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-0114?
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
How severe is CVE-2014-0114?
Severity scoring for CVE-2014-0114 is pending analysis. The EPSS model estimates a 95.82% probability of exploitation in the next 30 days.
How do I fix CVE-2014-0114?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-0114?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST