CVE-2014-0112
Fixed upstream EPSS 98%
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Products: apache struts
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.3.20 |