Skip to content

ClassLoader manipulation in Apache Struts

High severity GitHub Reviewed Published May 14, 2022 to the GitHub Advisory Database • Updated Dec 28, 2023

Package

maven org.apache.struts:struts2-core (Maven)

Affected versions

< 2.3.20

Patched versions

2.3.20

Description

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

References

Published by the National Vulnerability Database May 8, 2014
Published to the GitHub Advisory Database May 14, 2022
Reviewed Nov 3, 2022
Last updated Dec 28, 2023

Severity

High

EPSS score

1.726%
(88th percentile)

Weaknesses

No CWEs

CVE ID

CVE-2014-0116

GHSA ID

GHSA-hmhq-382q-mp56

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.