Sploitus

CVE-2014-0112

8 known exploits for CVE-2014-0112

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Affected products
Apache Struts
Apache Struts
< 2.3.16.2
Fix
Available
CVSS 2.0
7.5 HIGH
EPSS
97.9% (100th percentile)
Weakness
CWE-264
NVD status
Modified
Published
2014-04-29
CVE-2014-0112 at NVD
Authoritative description, scoring and affected products

8 known exploits for CVE-2014-0112

Proof-of-concept code and exploit modules indexed by Sploitus

Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution Exploit
2017-03-23 metasploitZDTRuby
Apache Struts ClassLoader Manipulation Remote Code Execution
2014-07-01 RootSEEBUGRuby
Struts2 远程命令执行
2014-05-04 RootSEEBUGRuby
Apache Struts ClassLoader Manipulation Remote Code Execution Exploit
2014-05-03 metasploitZDTRuby
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
2014-05-02 MetasploitEXPLOITDBRuby
Apache Struts ClassLoader Manipulation Remote Code Execution
2014-05-02 Mark ThomasPACKETSTORMRuby
Apache Struts ClassLoader Manipulation Remote Code Execution
2014-04-29 Mark Thomas, Przemyslaw Celej, Redsadic <julian.vilas@gmail.com>, Matthew Hall <hallm@sec-1.com>METASPLOITRuby
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)
2014-03-06 MetasploitEXPLOITDBRuby