The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to execute arbitrary code.

🗓️ 06 Jul 2016 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerability in Apache Struts CookieInterceptor getClass enables remote code execution via crafted requests.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Platform Symphony (CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116)	18 Jun 201801:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management, IBM Sterling Configure, Price, Quote and Sterling Web Channel are affected by Apache Struts 2 security vulnerabilities	11 Feb 202021:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
BDU FSTEC	The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to gain access to read, modify, or delete data.	6 Jul 201600:00	–	bdu_fstec
Circl	CVE-2014-0113	2 May 201400:00	–	circl
Check Point Advisories	Apache Struts ParametersInterceptor ClassLoader Security Bypass (CVE-2014-0094; CVE-2014-0112; CVE-2014-0113; CVE-2014-0114)	25 Apr 201400:00	–	checkpoint_advisories
CVE	CVE-2014-0113	29 Apr 201410:00	–	cve
Cvelist	CVE-2014-0113	29 Apr 201410:00	–	cvelist

Vulners

Node

apache strutsRange2.0.0–2.3.16.2

OR

oracle webcenter_sitesMatch11.1.1.8.0

OR

oracle webcenter_sitesMatch11.1.1.6.1

OR

ibm ibm_call_center_for_commerceMatch9.5.0

OR

ibm ibm_call_center_for_commerceMatch10.0

OR

oracle webcenter_sitesMatch7.6.2

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2015.html
cwiki	www.cwiki.apache.org/confluence/display/WW/S2-021
ibm	www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-0113
web	www.web.nvd.nist.gov/view/vuln/detail

21 Sep 2022 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 37.1

CVSS 27.5

EPSS0.82224

apache struts cookie interceptor get class method arbitrary code execution access control deficiency crafted requests