GHSA-vrwc-qjmw-5rjm

ClassLoader manipulation in Apache Struts

At a glance

Published: 2022-05-14 00:54 UTC
Updated: 2024-12-06 05:29 UTC
CVE: CVE-2014-0094

Description

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

Affected packages

Package	Versions
Maven · org.apache.struts:struts2-core	introduced 2.0.0, fixed 2.3.16.2
Maven · org.apache.struts.xwork:xwork-core	introduced 2.0.0, fixed 2.3.16.2

References

https://nvd.nist.gov/vuln/detail/CVE-2014-0094 ADVISORY
https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f WEB
https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62 WEB
https://github.com/apache/struts PACKAGE
http://jvn.jp/en/jp/JVN19294237/index.html WEB
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045 WEB
http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html WEB
http://struts.apache.org/release/2.3.x/docs/s2-020.html WEB
http://www-01.ibm.com/support/docview.wss?uid=swg21676706 WEB
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm WEB
http://www.konakart.com/downloads/ver-7-3-0-0-whats-new WEB
http://www.vmware.com/security/advisories/VMSA-2014-0007.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database