Every CVE Search/ Get API key

CVE-2014-0112

ClassLoader manipulation in Apache Struts

7.5 HighPublic exploitFix available

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Exploit likelihood

98.1%Up 23.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Record
CVE-2014-0112
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Record
CVE-2014-0112
Updated
2026-11-02
EUVDEUVD-2022-4820 No score

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Record
EUVD-2022-4820
Updated
2026-11-03
GitHub AdvisoriesGHSA-prjv-jj26-wf8h No score

ClassLoader manipulation in Apache Struts

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Record
GHSA-prjv-jj26-wf8h
Updated
2026-11-02
OSVGHSA-prjv-jj26-wf8h No score

ClassLoader manipulation in Apache Struts

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Record
GHSA-prjv-jj26-wf8h
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts2-core
Maven
 before 2.3.20
2.3.20
org.apache.struts:struts2-core
Maven
 before 2.3.20, plus listed versions
2.0.112.0.11.12.0.11.22.0.122.0.14
Show 33 moreShow less
2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.32.3.42.3.4.12.3.72.3.8
2.3.20

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)2014-05-02
Exploit-DBApache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)2014-03-06
MetasploitApache Struts ClassLoader Manipulation Remote Code Execution2014-03-06

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0112 is a high vulnerability (CVSS 7.5) in Apache Struts, published April 29, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.1%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.20.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open