Vulnerability Description
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVSS Score
5.0
MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Struts | >= 2.0.0, < 2.3.16.1 |
References
- http://jvn.jp/en/jp/JVN19294237/index.htmlThird Party AdvisoryVDB Entry
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045Third Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.hThird Party AdvisoryVDB Entry
- http://secunia.com/advisories/56440Vendor Advisory
- http://secunia.com/advisories/59178Permissions Required
- http://struts.apache.org/release/2.3.x/docs/s2-020.htmlVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706Third Party Advisory
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hThird Party Advisory
- http://www.konakart.com/downloads/ver-7-3-0-0-whats-newThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/531362/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/532549/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/65999Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1029876Third Party AdvisoryVDB Entry
- http://www.vmware.com/security/advisories/VMSA-2014-0007.htmlThird Party Advisory
FAQ
What is CVE-2014-0094?
CVE-2014-0094 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
How severe is CVE-2014-0094?
CVE-2014-0094 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-0094?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Struts.