Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-0114

CWE-20 — Improper Input ValidationCWE-47016 documents10 sources
Severity
7.5HIGH
EPSS
92.7%
top 0.24%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Apache Commons BeanutilsRedhat StrutsApache Struts
Timeline
PublishedApr 30
Latest updateMar 15

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages5 packages

▶Debiancommons-beanutils< 1.9.2-1+3
▶NVDapache/struts12 versions+11
▶CVEListV5redhat/strutsall versions under 1.3.10_1

🔴Vulnerability Details

5
OSV
Arbitrary code execution in Apache Commons BeanUtils↗2020-06-10
▶
GHSA
Arbitrary code execution in Apache Commons BeanUtils↗2020-06-10
▶
OSV
CVE-2014-0114: Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1↗2014-04-30
▶
CVEList
CVE-2014-0114: Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1↗2014-04-30
▶
VulnCheck
Apache commons_beanutils Improper Input Validation↗2014
▶

💥Exploits & PoCs

1
Exploit-DB
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)↗2014-03-06
▶

📋Vendor Advisories

5
Ubuntu
Apache Commons BeanUtils vulnerabilities↗2021-03-15
▶
Red Hat
JON: struts1 reversion of fix for CVE-2014-0114↗2019-10-02
▶
Red Hat
commons-beanutils: 'class' property is exposed, potentially leading to RCE↗2014-05-01
▶
Red Hat
1: Class Loader manipulation via request parameters↗2014-04-29
▶
Debian
CVE-2014-0114: commons-beanutils - Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in A...↗2014
▶

💬Community

4
Bugzilla
CVE-2019-3834 JON: struts1 reversion of fix for CVE-2014-0114↗2019-02-15
▶
Bugzilla
CVE-2014-3540 commons-beanutils: 'class' property is exposed, potentially leading to RCE↗2014-07-07
▶
Bugzilla
CVE-2014-0114 struts: Apache Struts 1: Class Loader manipulation via request parameters [fedora-all]↗2014-04-29
▶
Bugzilla
CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters↗2014-04-28
▶