CVE-2014-0116: Medium severity Apache struts vulnerability
CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0116?
CVE-2014-0116 is classified as a high severity vulnerability due to its potential for exploitation to manipulate the ClassLoader.
How do I fix CVE-2014-0116?
To fix CVE-2014-0116, upgrade to Apache Struts version 2.3.20 or later.
What versions of Apache Struts are affected by CVE-2014-0116?
CVE-2014-0116 affects Apache Struts versions prior to 2.3.20.
What can attackers achieve by exploiting CVE-2014-0116?
By exploiting CVE-2014-0116, attackers can potentially modify session state by manipulating the ClassLoader.
Is there a workaround for CVE-2014-0116 if I cannot upgrade?
If upgrading is not possible, consider restricting the use of wildcard patterns in cookie names as a temporary workaround.