CVE-2014-0112 Public exploit EPSS 98.1%

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which…

Official description · CVE.org

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Breakdown

60.0 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 8 years after disclosure. Public exploit code (Exploit-DB) was available 54 days before disclosure.

Public exploit codeExploit-DB6 Mar 201454 days before
Disclosed29 Apr 2014day 0
First seen exploitedVulnCheck KEV evidence11 May 2022+8 yrs

See the family tree

A fix was bypassed or incomplete 3 times over 4 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2012-0393The ParameterInterceptor component in Apache Struts before…8 Jan 2012
same family
CVE-2012-0394The DebuggingInterceptor component in Apache Struts before…8 Jan 2012
relatedMedium
Why these are linked:
- Same code patched: ParametersInterceptor.java (machine-matched)Functions: ParametersInterceptor, setDevModecommit 9cad25f commit 80e0318 commit 87935af
CVE-2012-4387Struts 2.0.0 through 2.3.4 allows remote attackers to cause a…5 Sep 2012
relatedMedium
Why these are linked:
- Same code patched: ParametersInterceptor.java (machine-matched)Functions: ParametersInterceptorcommit 80e0318 commit 87935af commit 2e2da29 commit 6315241
CVE-2014-0094The ParametersInterceptor in Apache Struts before 2.3.16.2…10 Mar 2014
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
- Similar weakness in the same product (machine-matched)same package + description similarity
This CVECVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not…29 Apr 2014
same family
CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a…29 Apr 2014
incomplete fixHigh
Why these are linked:
- Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…8 May 2014
same family
CVE-2015-1831The default exclude patterns (excludeParams) in Apache Struts…16 Jul 2015

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-prjv-jj26-wf8h

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.3.20 for CVE-2014-0112.

Affected versions

If you run	Upgrade to
All versions before 2.3.20	2.5.33first fix for this CVE: 2.3.20

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

14 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4820

Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)EDB-33142 · remote · multiple · 2014-05-02 · verified
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)EDB-41690 · remote · multiple · 2014-03-06 · verified

, 30 Oct 2026

98.1%Top 0.09%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.91%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 1634 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9991 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 Exploit-DB entries; 1 NVD exploit link; 1 Metasploit module 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total60.0

Record

Published: 29 Apr 2014
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_MISC 1

x_refsource_CONFIRM 5

third-party-advisory 4

mailing-list 2

vdb-entry 1

vendor-advisory 1

techniques