CVE-2014-0113: High severity Apache struts vulnerability
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 2.3.20
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0113?
CVE-2014-0113 is classified as a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2014-0113?
To fix CVE-2014-0113, upgrade Apache Struts to version 2.3.20 or later.
What versions of Apache Struts are affected by CVE-2014-0113?
Apache Struts versions prior to 2.3.20, specifically from 2.0.0 to 2.3.16.2, are affected by CVE-2014-0113.
What kind of attacks can be executed through CVE-2014-0113?
CVE-2014-0113 allows remote attackers to manipulate the ClassLoader, potentially leading to arbitrary code execution.
Is CVE-2014-0113 an easy vulnerability to exploit?
CVE-2014-0113 can be exploited with crafted requests, making it a significant risk for web applications using affected versions.