CVE-2014-0113
EXPLOITEDApache Struts <2.3.20 - RCE
Title source: llmDescription
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/33142
References (5)
Scores
EPSS
0.8205
EPSS Percentile
99.2%
Details
VulnCheck KEV
2022-05-11
CWE
CWE-264
Status
published
Products (2)
apache/struts
2.0.0 - 2.3.16.2
org.apache.struts/struts2-core
0 - 2.3.20Maven
Published
Apr 29, 2014
Tracked Since
Feb 18, 2026