CVE-2014-0113

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/59178Permissions Required
http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory
http://secunia.com/advisories/59178Permissions Required
http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/531952/100/0/threadedThird Party Advisory, VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-021Patch, Vendor Advisory

Timeline

Published: Apr 29, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01147.5Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir CVE-2014-01157.5Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot do CVE-2014-01165.8CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the ge CVE-2014-01174.3The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a deni CVE-2014-01184.3The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompr CVE-2014-01194.3Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML pars CVE-2014-01208.8Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arb CVE-2014-01219.8The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k paramet CVE-2014-01224.9mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for CVE-2014-01234.9The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) v CVE-2014-01244.0The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9 CVE-2014-01255.8repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in