CVE-2014-0112observed exploitation

CVE-2014-0112

Published · Updated

Follow this CVE+ Monitor org.apache.struts:struts2-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 98%
from disclosure to weaponsame day
Published on NVDApr 29
1st PoCMar 6
metasploitMar 6
VulnCheck+2934d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
1 product
Red Hat Fuse 7.3
fix ↗
Not affected
4 products — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5 · Red Hat Fuse 7 · Red Hat JBoss Fuse 6 · Red Hat JBoss Operations Network 3
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.