CVE-2014-0113 in Struts
Summary
CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
12/03/2013
Disclosure
04/29/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 69515 | Apache Struts CookieInterceptor access control | 264 | Proof-of-Concept | Official fix | CVE-2014-0113 |