NVD

Id
29047  
Name
CVE-2014-0114  
Description
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-04-30  
Modified Date
2017-01-06  
Seq
2014-0114  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153392 29047 CVE-2014-0114 http://advisories.mageia.org/MGASA-2014-0219.html  View
153393 29047 CVE-2014-0114 http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt  View
153394 29047 CVE-2014-0114 FEDORA-2014-9380  View
153395 29047 CVE-2014-0114 HPSBGN03041  View
153396 29047 CVE-2014-0114 HPSBMU03090  View
153397 29047 CVE-2014-0114 HPSBST03160  View
153398 29047 CVE-2014-0114 [oss-security] 20140616 CVE request for commons-beanutils: "class" property is exposed, potentially leading to RCE  View
153399 29047 CVE-2014-0114 [oss-security] 20140707 Re: CVE request for commons-beanutils: "class" property is exposed, potentially leading to RCE  View
153400 29047 CVE-2014-0114 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153401 29047 CVE-2014-0114 57477  View
153402 29047 CVE-2014-0114 58710  View
153403 29047 CVE-2014-0114 58947  View
153404 29047 CVE-2014-0114 59118  View
153405 29047 CVE-2014-0114 59228  View
153406 29047 CVE-2014-0114 59245  View
153407 29047 CVE-2014-0114 59246  View
153408 29047 CVE-2014-0114 59430  View
153409 29047 CVE-2014-0114 59464  View
153410 29047 CVE-2014-0114 59479  View
153411 29047 CVE-2014-0114 59480  View
153412 29047 CVE-2014-0114 59718  View
153413 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21674128  View
153414 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21674812  View
153415 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21675266  View
153416 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21675387  View
153417 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21675689  View
153418 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21675898  View
153419 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21675972  View
153420 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21676091  View
153421 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21676110  View
153422 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21676303  View
153423 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21676375  View
153424 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21676931  View
153425 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg21677110  View
153426 29047 CVE-2014-0114 http://www-01.ibm.com/support/docview.wss?uid=swg27042296  View
153427 29047 CVE-2014-0114 DSA-2940  View
153428 29047 CVE-2014-0114 http://www.ibm.com/support/docview.wss?uid=swg21675496  View
153429 29047 CVE-2014-0114 MDVSA-2014:095  View
153430 29047 CVE-2014-0114 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
153431 29047 CVE-2014-0114 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
153432 29047 CVE-2014-0114 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
153433 29047 CVE-2014-0114 http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html  View
153434 29047 CVE-2014-0114 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
153435 29047 CVE-2014-0114 67121  View
153436 29047 CVE-2014-0114 http://www.vmware.com/security/advisories/VMSA-2014-0008.html  View
153437 29047 CVE-2014-0114 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
153438 29047 CVE-2014-0114 https://access.redhat.com/solutions/869353  View
153439 29047 CVE-2014-0114 https://bugzilla.redhat.com/show_bug.cgi?id=1091938  View
153440 29047 CVE-2014-0114 https://bugzilla.redhat.com/show_bug.cgi?id=1116665  View
153441 29047 CVE-2014-0114 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755  View
153442 29047 CVE-2014-0114 https://issues.apache.org/jira/browse/BEANUTILS-463  View
153443 29047 CVE-2014-0114 GLSA-201607-09  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12037 JVNDB-2014-000056 TERASOLUNA Server Framework for Java において ClassLoader が操作可能な脆弱性 株式会社エヌ・ティ・ティ・データ が提供する TERASOLUNA Server Framework for Java(Web) は、ウェブアプリケーションを作成するためのソフトウェアフレームワークです。TERASOLUNA Server Framework for Java(Web) は、Apache Struts 1.2.9 を使用しており、Apache Struts 1.2.9 には、ClassLoader が操作可能な脆弱性 (CVE-2014-0114) が存在します。そのため、TERASOLUNA Server Framework for Java(Web) も同脆弱性の影響を受けます。 CVE-2014-0114 67515 CVE-2014-0114 29047 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000056.html 2014-06-17 2015-08-07 View
13433 JVNDB-2014-002308 Apache Struts およびその他の製品で配布される Apache Commons BeanUtils における ClassLoader を操作される脆弱性 Apache Struts の lib/commons-beanutils-1.8.0.jar および commons-beanutils を必要とするその他の製品で配布される Apache Commons BeanUtils は、class 属性を抑制しないため、ClassLoader を "操作 (manipulate)" され、任意のコードを実行される脆弱性が存在します。 CVE-2014-0114 67515 CVE-2014-0114 29047 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002308.html 2014-04-28 2016-08-02 View