CVE-2014-0094
Summary
| CVE | CVE-2014-0094 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-03-11 13:00:37 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:N/I:P/A:N
Problem Types: NVD-CWE-noinfo | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| S2-020 - Apache Struts 2 Wiki - Apache Software Foundation | af854a3a-2127-422b-91ae-364da2661108 | struts.apache.org | Vendor Advisory |
| Security Advisory-Apache Struts2 vulnerability on Huawei multiple products - Huawei PSIRT | af854a3a-2127-422b-91ae-364da2661108 | www.huawei.com | Third Party Advisory |
| Security Advisory SA59178 - IBM Sterling Products Apache Struts Multiple Security Bypass Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Permissions Required |
| VMware Security Advisory 2014-0007 ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | Third Party Advisory, VDB Entry |
| Apache Struts Bugs Let Remote Users Deny Service and Manipulate the ClassLoader - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Third Party Advisory, VDB Entry |
| VMSA-2014-0007.2 | United States | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | Third Party Advisory |
| JVN#19294237: Apache Struts vulnerable to ClassLoader manipulation | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | Third Party Advisory, VDB Entry |
| Oracle Critical Patch Update - April 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| jvndb.jvn.jp/jvndb/JVNDB-2014-000045 | af854a3a-2127-422b-91ae-364da2661108 | jvndb.jvn.jp | Third Party Advisory, VDB Entry |
| Security Advisory SA56440 - Apache Struts Two Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Security Bulletin: IBM Sterling Order Management, IBM Sterling Configure, Price, Quote and Sterling Web Channel are affected by Apache Struts 2 security vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Ver 7.3.0.0 – What’s New? - KonaKart | af854a3a-2127-422b-91ae-364da2661108 | www.konakart.com | Third Party Advisory |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.