What is CVE-2014-0116?

CVE-2014-0116 is a vulnerability in Apache Struts, classified under CWE-264. Published 2014-05-08.

Is CVE-2014-0116 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Struts

CVE-2014-0116

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

EPSS: 0.065 (93.1th percentile) — read the EPSS interpretation.

Affected products

Apache Struts — versions 2.0.0, 2.0.1, 2.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

References

secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)

Frequently asked questions

What is CVE-2014-0116?: CVE-2014-0116 is a vulnerability in Apache Struts, classified under CWE-264. Published 2014-05-08.
Is CVE-2014-0116 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.