CVE-2014-0114

🗓️ 30 Apr 2014 10:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 506 Views🌐 WEB

Apache Commons BeanUtils vulnerability in Apache Struts 1.x allows remote code execution via class paramete

Reporter	Title	Published	Views	Family All 241
IBM Security Bulletins	Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0114)	16 Jun 201813:06	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Insight - Apache Struts used by WebSphere Application Server 6.1 and 7 (CVE-2014-0114)	17 Jun 201804:54	–	ibm
IBM Security Bulletins	Security Bulletin: Class loader manipulation vulnerability in IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2014-0114)	15 Jun 201807:00	–	ibm
IBM Security Bulletins	Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server (CVE-2014-0114) Does Not Affect IBM Security Key Lifecycle Manager	20 Jul 201814:15	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 1.1 Vulnerabilities in IBM Library Support for Struts	16 Jan 202609:15	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with Rational ClearCase	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server CVE-2014-0114	15 Jun 201807:00	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Web Interface for Content Management (WEBi)	17 Jun 201812:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager March 2023 - CVE-2014-0114, CVE-2019-10086, CVE-2023-24998	11 Apr 202314:02	–	ibm
IBM Security Bulletins	Security Bulletin: ClassLoader manipulation with Apache Struts in Rational Application Developer affecting Rational Business Developer (CVE-2014-0114)	3 Aug 201804:23	–	ibm

NVD

Node

apache commons_beanutilsRange≤1.9.1

Node

apache strutsMatch1.0

apache strutsMatch1.0.2

apache strutsMatch1.1

apache strutsMatch1.1b1

apache strutsMatch1.1b2

apache strutsMatch1.1b3

apache strutsMatch1.1rc1

apache strutsMatch1.1rc2

apache strutsMatch1.2.2

apache strutsMatch1.2.4

apache strutsMatch1.2.6

apache strutsMatch1.2.7

apache strutsMatch1.2.8

apache strutsMatch1.2.9

apache strutsMatch1.3.5

apache strutsMatch1.3.8

apache strutsMatch1.3.10

Source	Link
secunia	www.secunia.com/advisories/59718
www-01	www.www-01.ibm.com/support/docview.wss
lists	www.lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E
lists	www.lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20140911-0001/
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
secunia	www.secunia.com/advisories/58710
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
lists	www.lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E
secunia	www.secunia.com/advisories/57477

Parameter	Position	Path	Description	CWE
class.classLoader.resources.dirContext.docBase	query param	oscar/login.do	Stealing ClassLoader context via Struts vulnerability to manipulate classLoader	CWE-20
file	path	oscar/admin/GenerateTraceabilityReportAction.do	RPC to generate traceability report exploiting classLoader manipulation	CWE-20
submit	path	oscar/admin/GenerateTraceabilityReportAction.do	RPC to generate traceability report exploiting classLoader manipulation	CWE-20
importlog	query param	oscar/form/importLogDownload.do	Path traversal to read arbitrary files via importLogDownload.do	CWE-20
filename	query param	oscar/eform/deleteImage.do	Path traversal vulnerability allowing file deletion via filename parameter	CWE-20

17 Jun 2026 00:02Current

8.4High risk

Vulners AI Score8.4

CVSS 27.5

EPSS0.96121

CWE-20