1. Home
  2. CVE Database
  3. CVE-2014-0114
HIGH · 7.5

CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the c...

Vulnerability Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

CVSS Score

7.5

HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
ApacheCommons Beanutils<= 1.9.1
ApacheStruts1.0

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2014-0114?

CVE-2014-0114 is a vulnerability with a CVSS score of 7.5 (HIGH). Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the c...

How severe is CVE-2014-0114?

CVE-2014-0114 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-0114?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Commons Beanutils, Apache Struts.