CVE-2014-0114

The CVE-2014-0114 issue affects Apache Struts 1.x through 1.3.10 (and related products using commons-beanutils) where the ActionForm/ClassLoader handling could be manipulated via a class parameter passed to getClass, enabling remote code execution. The F5 advisory confirms the vulnerability impac...

CVE-2014-0094

CVE-2014-0094 affects Apache Struts where the ParametersInterceptor before 2.3.16.2 allows a crafted request to pass a class parameter to getClass(), enabling ClassLoader manipulation and remote code execution in vulnerable deployments. Public references note exploitation in versions prior to 2.3...

CVE-2014-0112

Summary (facts from sources): CVE-2014-0112 affects Apache Struts 2.x where the ParametersInterceptor does not properly restrict access to the getClass method, enabling remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. The F5 advisories confirm the v...

CVE-2014-0113

The CVE-2014-0113 issue affects Apache Struts CookieInterceptor in Struts 2.x prior to 2.3.20 (and related advisories reference 2.3.16.2), where a wildcard cookiesName value allows access to getClass, enabling potential ClassLoader manipulation and remote code execution via a crafted request. Thi...

CVE-2014-0116

Apache Struts 2.x vulnerable to ClassLoader manipulation via CookieInterceptor (getClass access) when using wildcard cookiesName, allowing remote code execution. Affects Struts 2.x before 2.3.20 (and multiple related CVEs linked to the same class loader flaw, including CVE-2014-0112 and CVE-2014-...

CVE-2014-7809

CVE-2014-7809 affects Apache Struts 2.0.0–2.3.x with predictable values, enabling remote CSRF bypass. Connected IBM advisories confirm impact on IBM FlashSystem 840/V840-AC0/AC1 nodes and IBM SAN Storwize, IBM Sterling Order Management, Call Center, and related products where Struts is used as p...