Patchfirst
Patchfirst
CVE-2014-0094 Public exploit EPSS 99.4%

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

Summary

The ParametersInterceptor component of Apache Struts, in versions before 2.3.16.2, lets the ClassLoader be manipulated through the class parameter, which is passed to the getClass method. A remote attacker can exploit this by sending crafted requests that include the class parameter, with no stated requirement for authentication or user interaction.

Heading is the official description · CVE.org
Breakdown
60.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 8 years after disclosure. Public exploit code (Exploit-DB) was available 4 days before disclosure.

  1. Public exploit codeExploit-DB4 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+8 yrs

See the family tree

A fix was bypassed or incomplete 3 times over 4 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2012-0393The ParameterInterceptor component in Apache Struts before…8 Jan 2012
  2. same family
    CVE-2012-0394The DebuggingInterceptor component in Apache Struts before…8 Jan 2012
  3. relatedMedium

    Why these are linked:

    CVE-2012-4387Struts 2.0.0 through 2.3.4 allows remote attackers to cause a…5 Sep 2012
  4. relatedMedium

    Why these are linked:

    This CVECVE-2014-0094The ParametersInterceptor in Apache Struts before 2.3.16.2…10 Mar 2014
  5. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not…29 Apr 2014
  6. same family
    CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a…29 Apr 2014
  7. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…8 May 2014
  8. same family
    CVE-2015-1831The default exclude patterns (excludeParams) in Apache Struts…16 Jul 2015

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-vrwc-qjmw-5rjm

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.3.16.2 for CVE-2014-0094.

Affected versions

If you runUpgrade to
2.0.0 up to 2.3.16.22.5.33first fix for this CVE: 2.3.16.2

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavenorg.apache.struts.xwork:xwork-core
    Affected: 2.0.0 up to 2.3.16.2Upgrade to 2.3.18 or later
    GHSA-vrwc-qjmw-5rjm

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

15 links, grouped by NVD tag

x_refsource_MISC 1

packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

third-party-advisory 4

secunia.com/advisories/59178jvn.jp/en/jp/JVN19294237/index.htmljvndb.jvn.jp/jvndb/JVNDB-2014-000045secunia.com/advisories/56440

x_refsource_CONFIRM 6

vmware.com/security/advisories/VMSA-2014-0007.htmlkonakart.com/downloads/ver-7-3-0-0-whats-neworacle.com/technetwork/topics/security/cpuapr2015-2365600.htmlhuawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htmstruts.apache.org/release/2.3.x/docs/s2-020.htmlwww-01.ibm.com/support/docview.wss?uid=swg21676706

mailing-list 2

securityfocus.com/archive/1/531362/100/0/threadedsecurityfocus.com/archive/1/532549/100/0/threaded

vdb-entry 2

securitytracker.com/id/1029876securityfocus.com/bid/65999
↑ ↓ chooseEnter openEsc close