CVE-2014-0114

🗓️ 30 Apr 2014 10:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 558 Views🌐 WEB

Apache Commons BeanUtils vulnerability in Apache Struts 1.x allows remote code execution via class paramete

Reporter	Title	Published	Views	Family All 257
IBM Security Bulletins	Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0114)	16 Jun 201813:06	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Insight - Apache Struts used by WebSphere Application Server 6.1 and 7 (CVE-2014-0114)	17 Jun 201804:54	–	ibm
IBM Security Bulletins	Security Bulletin: Class loader manipulation vulnerability in IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2014-0114)	15 Jun 201807:00	–	ibm
IBM Security Bulletins	Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server (CVE-2014-0114) Does Not Affect IBM Security Key Lifecycle Manager	20 Jul 201814:15	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts 1.1 Vulnerabilities in IBM Library Support for Struts	16 Jan 202609:15	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with Rational ClearCase	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server CVE-2014-0114	15 Jun 201807:00	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Web Interface for Content Management (WEBi)	17 Jun 201812:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager March 2023 - CVE-2014-0114, CVE-2019-10086, CVE-2023-24998	11 Apr 202314:02	–	ibm
IBM Security Bulletins	Security Bulletin: ClassLoader manipulation with Apache Struts in Rational Application Developer affecting Rational Business Developer (CVE-2014-0114)	3 Aug 201804:23	–	ibm

NVD

Node

apache commons_beanutilsRange≤1.9.1

Node

apache strutsMatch1.0

apache strutsMatch1.0.2

apache strutsMatch1.1

apache strutsMatch1.1b1

apache strutsMatch1.1b2

apache strutsMatch1.1b3

apache strutsMatch1.1rc1

apache strutsMatch1.1rc2

apache strutsMatch1.2.2

apache strutsMatch1.2.4

apache strutsMatch1.2.6

apache strutsMatch1.2.7

apache strutsMatch1.2.8

apache strutsMatch1.2.9

apache strutsMatch1.3.5

apache strutsMatch1.3.8

apache strutsMatch1.3.10

Source	Link
secunia	www.secunia.com/advisories/59718
www-01	www.www-01.ibm.com/support/docview.wss
lists	www.lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E
lists	www.lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20140911-0001/
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
secunia	www.secunia.com/advisories/58710
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
lists	www.lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E
secunia	www.secunia.com/advisories/57477

Parameter	Position	Path	Description	CWE
class.classLoader.resources.dirContext.docBase	query param	/oscar/login.do?class.classLoader.resources.dirContext.docBase=/var/lib/tomcat7/webapps/OscarDocument/oscar_mcmaster	Struts classLoader manipulation via class parameter disclosed in OSCAR/Struts vulnerability allowing remote access to sensitive resources	CWE-20
class.classLoader.resources.dirContext.docBase	query param	/oscar/login.do?class.classLoader.resources.dirContext.docBase=invalid	Potential DoS via invalid classLoader/docBase parameter in Struts 1.x environment	CWE-20
importlog	query param	/oscar/form/importLogDownload.do?importlog=/var/lib/tomcat7/webapps/OscarDocument/oscar_mcmaster/OscarBackup.sql.gz	Path traversal via importLogDownload.do leading to arbitrary file read	CWE-20
filename	query param	/oscar/eform/deleteImage.do?filename=../../../../oscar/index.jsp	Path traversal through deleteImage.do allowing manipulation of server files	CWE-20

17 Jun 2026 00:02Current

8.4High risk

Vulners AI Score8.4

CVSS 27.5

EPSS0.9895

CWE-20