{"id":"CVE-2014-0114","aliases":["CLSA-2026-1775781177","CLSA-2026-1776991051","CLSA-2026-1779756520","CLSA-2026-1788410329","CLSA-2026-1788757862","CLSA-2026-1789363246","CLSA-2026-1791878536","CLSA-2026-1792010669","CLSA-2026-1793128163","DEBIAN-CVE-2014-0114","DLA-57-1","DSA-2940-1","EUVD-2020-0504","GHSA-p66x-2cv9-qq3v","MGASA-2014-0219","RHSA-2014:0474","RHSA-2014:0500","ROOT-APP-MAVEN-CVE-2014-0114","SUSE-RU-2015:0611-1","SUSE-SU-2015:0886-1","SUSE-SU-2025:02056-1","UBUNTU-CVE-2014-0114","USN-4766-1","USN-8322-2","openSUSE-SU-2024:10617-1","openSUSE-SU-2026:11105-1"],"status":"published","title":"Arbitrary code execution in Apache Commons BeanUtils","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.99032,"percentile":0.9993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-04-30T10:00:00Z","modified":"2026-10-28T01:45:02Z","exploits":[{"source":"exploitdb","id":"EDB-41690","title":"Apache Struts \u003c 1.3.10 / \u003c 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2014-03-06","verified":true,"url":"https://www.exploit-db.com/exploits/41690"},{"source":"metasploit","id":"exploit/multi/http/struts_code_exec_classloader","title":"Apache Struts ClassLoader Manipulation Remote Code Execution","type":"exploit","platform":"Linux,Windows","date":"2014-03-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/struts_code_exec_classloader"},{"source":"pocgithub","id":"rgielen/struts1filter","title":"rgielen/struts1filter","date":"2014-05-22","url":"https://github.com/rgielen/struts1filter"},{"source":"pocgithub","id":"ricedu/struts1-patch","title":"ricedu/struts1-patch","date":"2014-06-10","url":"https://github.com/ricedu/struts1-patch"},{"source":"pocgithub","id":"aenlr/strutt-cve-2014-0114","title":"aenlr/strutt-cve-2014-0114","date":"2019-05-27","url":"https://github.com/aenlr/strutt-cve-2014-0114"}],"fixes":[{"ecosystem":"Maven","package":"commons-beanutils:commons-beanutils","fixed_in":["1.9.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","fixed_in":["1.8.0-tuxcare.1","1.9.2-tuxcare.1","1.9.0-tuxcare.2","1.8.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"commons-beanutils","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"commons-beanutils","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"commons-beanutils","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libstruts1.2-java","fixed_in":["1.2.9-4+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libstruts1.2-java","fixed_in":["1.2.9-5+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"struts","fixed_in":["1.3.10-3.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"struts","fixed_in":["1.3.10-4.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-debuginfo","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-javadoc","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-manual","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-webapps-tomcat5","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-debuginfo","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-javadoc","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-manual","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-webapps-tomcat5","fixed_in":["0:1.2.9-4jpp.8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-core","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-extras","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-taglib","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-tiles","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-core","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-extras","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-taglib","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-tiles","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-core","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-extras","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-taglib","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-tiles","fixed_in":["0:1.3.10-6.ep5.el6"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"commons-beanutils:commons-beanutils","fixed_in":["1.8.3-aikido.2","1.9.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.commons-beanutils:commons-beanutils","fixed_in":["1.8.3-root.io.2","1.9.4-root.io.1","1.9.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"commons-beanutils","fixed_in":["1.9.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"commons-beanutils","fixed_in":["1.9.2-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"commons-beanutils","fixed_in":["1.9.3-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6-tuxcare.1"}]}],"versions":["1.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.0-tuxcare.1"}]}],"versions":["1.8.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2"},{"fixed":"1.9.2-tuxcare.1"}]}],"versions":["1.9.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.3"},{"fixed":"1.9.3-tuxcare.1"}]}],"versions":["1.9.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.0-tuxcare.2"}]}],"versions":["1.9.0","1.9.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"]},{"source":"osv","ecosystem":"Debian:12","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libstruts1.2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-4+deb6u1"}]}],"versions":["1.2.9-4"]},{"source":"osv","ecosystem":"Debian:7","package":"libstruts1.2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-5+deb7u1"}]}],"versions":["1.2.9-5"]},{"source":"osv","ecosystem":"Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.4"}]}],"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-3.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-4.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"struts-webapps-tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"struts-webapps-tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-4jpp.8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-taglib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.5::el6","package":"struts-tiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-taglib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.6::el6","package":"struts-tiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-taglib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"struts-tiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.10-6.ep5.el6"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-aikido.2"},{"fixed":"1.9.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.commons-beanutils:commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-root.io.2"},{"fixed":"1.9.4-root.io.1"},{"fixed":"1.9.4-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1ubuntu0.1~esm1"}]}],"versions":["1.8.3-4","1.9.0-1","1.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-3ubuntu0.1~esm1"}]}],"versions":["1.9.2-1","1.9.2-2","1.9.2-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-1ubuntu0.1~esm1"}]}],"versions":["1.9.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1ubuntu0.1~esm1"}]}],"versions":["1.8.3-4","1.9.0-1","1.9.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-3ubuntu0.1~esm1"}]}],"versions":["1.9.2-1","1.9.2-2","1.9.2-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-1ubuntu0.1~esm1"}]}],"versions":["1.9.3-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-3ubuntu0.1~esm2"}]}],"versions":["1.9.2-1","1.9.2-2","1.9.2-3","1.9.2-3ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-beanutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3.7"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"commons_beanutils"},{"vendor":"apache","product":"struts"}],"references":[{"url":"http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/57477","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0008.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/BEANUTILS-463","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/58710","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:095","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0012.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675689","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21674812","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20140911-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59464","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59118","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180629-0006/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675387","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://access.redhat.com/solutions/869353","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1091938","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0219.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/60703","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675972","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676375","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2014/07/08/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2669","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201607-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141451023707502\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675898","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676110","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg27042296","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676303","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59228","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59246","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116665","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://openwall.com/lists/oss-security/2014/06/15/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/59245","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=140801096002766\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21674128","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676931","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/60177","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21675496","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2940","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675266","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59014","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677110","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676091","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/67121","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/59480","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=140119284401582\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://secunia.com/advisories/59479","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59704","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58947","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59718","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59430","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58851","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1%40%3Cdev.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859%40%3Cdev.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3%40%3Cnotifications.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639%40%3Ccommits.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f%40%3Cnotifications.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86%40%3Cdev.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25%40%3Cdev.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f%40%3Cuser.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40%40%3Cgitbox.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2995","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r458d61eaeadecaad04382ebe583230bc027f48d9e85e4731bc573477%40%3Ccommits.dolphinscheduler.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0114","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859@%3Cdev.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f@%3Cuser.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5@%3Ccommits.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd@%3Ccommits.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1@%3Cdev.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25@%3Cdev.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639@%3Ccommits.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40@%3Cgitbox.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86@%3Cdev.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f@%3Cnotifications.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3@%3Cnotifications.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-COMMONSBEANUTILS-30077","tags":["web"]},{"url":"https://web.archive.org/web/20140618110851/http://www.securityfocus.com/bid/67121","tags":["web"]},{"url":"https://web.archive.org/web/20150710065242/http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["web"]},{"url":"https://github.com/apache/commons-beanutils/pull/7","tags":["web"]},{"url":"https://github.com/apache/commons-beanutils/commit/62e82ad92cf4818709d6044aaf257b73d42659a4","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20180629-0006","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20140911-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p66x-2cv9-qq3v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0114","tags":["advisory"]},{"url":"https://github.com/apache/commons-beanutils","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0219.html","tags":["advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0474.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13342","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0474","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0474.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0114","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0500","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0500.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150611-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/653265","tags":["report"]},{"url":"https://bugzilla.suse.com/767279","tags":["report"]},{"url":"https://bugzilla.suse.com/808947","tags":["report"]},{"url":"https://bugzilla.suse.com/841731","tags":["report"]},{"url":"https://bugzilla.suse.com/855389","tags":["report"]},{"url":"https://bugzilla.suse.com/858971","tags":["report"]},{"url":"https://bugzilla.suse.com/860299","tags":["report"]},{"url":"https://bugzilla.suse.com/862408","tags":["report"]},{"url":"https://bugzilla.suse.com/867836","tags":["report"]},{"url":"https://bugzilla.suse.com/870159","tags":["report"]},{"url":"https://bugzilla.suse.com/872029","tags":["report"]},{"url":"https://bugzilla.suse.com/872298","tags":["report"]},{"url":"https://bugzilla.suse.com/872351","tags":["report"]},{"url":"https://bugzilla.suse.com/875231","tags":["report"]},{"url":"https://bugzilla.suse.com/875452","tags":["report"]},{"url":"https://bugzilla.suse.com/878550","tags":["report"]},{"url":"https://bugzilla.suse.com/878553","tags":["report"]},{"url":"https://bugzilla.suse.com/879904","tags":["report"]},{"url":"https://bugzilla.suse.com/879992","tags":["report"]},{"url":"https://bugzilla.suse.com/879998","tags":["report"]},{"url":"https://bugzilla.suse.com/880001","tags":["report"]},{"url":"https://bugzilla.suse.com/880022","tags":["report"]},{"url":"https://bugzilla.suse.com/880026","tags":["report"]},{"url":"https://bugzilla.suse.com/880027","tags":["report"]},{"url":"https://bugzilla.suse.com/880081","tags":["report"]},{"url":"https://bugzilla.suse.com/880087","tags":["report"]},{"url":"https://bugzilla.suse.com/880327","tags":["report"]},{"url":"https://bugzilla.suse.com/880388","tags":["report"]},{"url":"https://bugzilla.suse.com/880936","tags":["report"]},{"url":"https://bugzilla.suse.com/881111","tags":["report"]},{"url":"https://bugzilla.suse.com/881225","tags":["report"]},{"url":"https://bugzilla.suse.com/881522","tags":["report"]},{"url":"https://bugzilla.suse.com/881711","tags":["report"]},{"url":"https://bugzilla.suse.com/882468","tags":["report"]},{"url":"https://bugzilla.suse.com/883009","tags":["report"]},{"url":"https://bugzilla.suse.com/883057","tags":["report"]},{"url":"https://bugzilla.suse.com/883379","tags":["report"]},{"url":"https://bugzilla.suse.com/883487","tags":["report"]},{"url":"https://bugzilla.suse.com/884051","tags":["report"]},{"url":"https://bugzilla.suse.com/884081","tags":["report"]},{"url":"https://bugzilla.suse.com/884350","tags":["report"]},{"url":"https://bugzilla.suse.com/884366","tags":["report"]},{"url":"https://bugzilla.suse.com/885889","tags":["report"]},{"url":"https://bugzilla.suse.com/886391","tags":["report"]},{"url":"https://bugzilla.suse.com/886421","tags":["report"]},{"url":"https://bugzilla.suse.com/887538","tags":["report"]},{"url":"https://bugzilla.suse.com/887879","tags":["report"]},{"url":"https://bugzilla.suse.com/889363","tags":["report"]},{"url":"https://bugzilla.suse.com/889605","tags":["report"]},{"url":"https://bugzilla.suse.com/889721","tags":["report"]},{"url":"https://bugzilla.suse.com/889739","tags":["report"]},{"url":"https://bugzilla.suse.com/889905","tags":["report"]},{"url":"https://bugzilla.suse.com/892707","tags":["report"]},{"url":"https://bugzilla.suse.com/892711","tags":["report"]},{"url":"https://bugzilla.suse.com/893608","tags":["report"]},{"url":"https://bugzilla.suse.com/895001","tags":["report"]},{"url":"https://bugzilla.suse.com/895961","tags":["report"]},{"url":"https://bugzilla.suse.com/896029","tags":["report"]},{"url":"https://bugzilla.suse.com/896109","tags":["report"]},{"url":"https://bugzilla.suse.com/896238","tags":["report"]},{"url":"https://bugzilla.suse.com/896244","tags":["report"]},{"url":"https://bugzilla.suse.com/896254","tags":["report"]},{"url":"https://bugzilla.suse.com/896844","tags":["report"]},{"url":"https://bugzilla.suse.com/897723","tags":["report"]},{"url":"https://bugzilla.suse.com/898242","tags":["report"]},{"url":"https://bugzilla.suse.com/898426","tags":["report"]},{"url":"https://bugzilla.suse.com/898428","tags":["report"]},{"url":"https://bugzilla.suse.com/899266","tags":["report"]},{"url":"https://bugzilla.suse.com/900956","tags":["report"]},{"url":"https://bugzilla.suse.com/901058","tags":["report"]},{"url":"https://bugzilla.suse.com/901108","tags":["report"]},{"url":"https://bugzilla.suse.com/901193","tags":["report"]},{"url":"https://bugzilla.suse.com/901675","tags":["report"]},{"url":"https://bugzilla.suse.com/901776","tags":["report"]},{"url":"https://bugzilla.suse.com/901927","tags":["report"]},{"url":"https://bugzilla.suse.com/901928","tags":["report"]},{"url":"https://bugzilla.suse.com/901958","tags":["report"]},{"url":"https://bugzilla.suse.com/902182","tags":["report"]},{"url":"https://bugzilla.suse.com/902373","tags":["report"]},{"url":"https://bugzilla.suse.com/902494","tags":["report"]},{"url":"https://bugzilla.suse.com/902503","tags":["report"]},{"url":"https://bugzilla.suse.com/902915","tags":["report"]},{"url":"https://bugzilla.suse.com/903064","tags":["report"]},{"url":"https://bugzilla.suse.com/903720","tags":["report"]},{"url":"https://bugzilla.suse.com/903723","tags":["report"]},{"url":"https://bugzilla.suse.com/903880","tags":["report"]},{"url":"https://bugzilla.suse.com/903961","tags":["report"]},{"url":"https://bugzilla.suse.com/904690","tags":["report"]},{"url":"https://bugzilla.suse.com/904699","tags":["report"]},{"url":"https://bugzilla.suse.com/904703","tags":["report"]},{"url":"https://bugzilla.suse.com/904732","tags":["report"]},{"url":"https://bugzilla.suse.com/904841","tags":["report"]},{"url":"https://bugzilla.suse.com/904959","tags":["report"]},{"url":"https://bugzilla.suse.com/905072","tags":["report"]},{"url":"https://bugzilla.suse.com/905263","tags":["report"]},{"url":"https://bugzilla.suse.com/905530","tags":["report"]},{"url":"https://bugzilla.suse.com/906850","tags":["report"]},{"url":"https://bugzilla.suse.com/906851","tags":["report"]},{"url":"https://bugzilla.suse.com/906887","tags":["report"]},{"url":"https://bugzilla.suse.com/907086","tags":["report"]},{"url":"https://bugzilla.suse.com/907106","tags":["report"]},{"url":"https://bugzilla.suse.com/907337","tags":["report"]},{"url":"https://bugzilla.suse.com/907527","tags":["report"]},{"url":"https://bugzilla.suse.com/907586","tags":["report"]},{"url":"https://bugzilla.suse.com/907643","tags":["report"]},{"url":"https://bugzilla.suse.com/907645","tags":["report"]},{"url":"https://bugzilla.suse.com/907646","tags":["report"]},{"url":"https://bugzilla.suse.com/907677","tags":["report"]},{"url":"https://bugzilla.suse.com/907809","tags":["report"]},{"url":"https://bugzilla.suse.com/908317","tags":["report"]},{"url":"https://bugzilla.suse.com/908320","tags":["report"]},{"url":"https://bugzilla.suse.com/908849","tags":["report"]},{"url":"https://bugzilla.suse.com/909724","tags":["report"]},{"url":"https://bugzilla.suse.com/910243","tags":["report"]},{"url":"https://bugzilla.suse.com/910482","tags":["report"]},{"url":"https://bugzilla.suse.com/910494","tags":["report"]},{"url":"https://bugzilla.suse.com/911166","tags":["report"]},{"url":"https://bugzilla.suse.com/911180","tags":["report"]},{"url":"https://bugzilla.suse.com/911272","tags":["report"]},{"url":"https://bugzilla.suse.com/911808","tags":["report"]},{"url":"https://bugzilla.suse.com/912035","tags":["report"]},{"url":"https://bugzilla.suse.com/912057","tags":["report"]},{"url":"https://bugzilla.suse.com/912886","tags":["report"]},{"url":"https://bugzilla.suse.com/913215","tags":["report"]},{"url":"https://bugzilla.suse.com/913221","tags":["report"]},{"url":"https://bugzilla.suse.com/913939","tags":["report"]},{"url":"https://bugzilla.suse.com/914260","tags":["report"]},{"url":"https://bugzilla.suse.com/914437","tags":["report"]},{"url":"https://bugzilla.suse.com/914900","tags":["report"]},{"url":"https://bugzilla.suse.com/915140","tags":["report"]},{"url":"https://bugzilla.suse.com/919448","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9130","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150886-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/875455","tags":["report"]},{"url":"https://bugzilla.suse.com/924887","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0899","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243793","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48734","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-0114","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4766-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10086","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8322-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2161582","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10086","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:00:00Z","modified":"2026-10-14T16:20:55.413Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2020-0504","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:00:00Z","modified":"2026-10-14T16:20:55Z","updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-p66x-2cv9-qq3v","title":"Arbitrary code execution in Apache Commons BeanUtils","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2020-06-10T23:38:01Z","modified":"2024-06-05T15:57:12Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:53.703286Z"}],"nvd":[{"id":"CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:49:03.973Z","modified":"2026-10-14T17:17:30.367Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"CLSA-2026-1775781177","title":"TuxCare security update for commons-beanutils:commons-beanutils (2 CVEs)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 2 CVEs. Fixed in 1.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:24.837781006Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776991051","title":"TuxCare security update for commons-beanutils:commons-beanutils (2 CVEs)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 2 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:18.276727658Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1779756520","title":"TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:45:15.821717256Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1788410329","title":"TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.","status":"withdrawn","published":"2026-09-03T04:38:49Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788757862","title":"TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1.","status":"published","published":"2026-09-07T05:11:02Z","modified":"2026-10-15T09:46:55.107378548Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789363246","title":"TuxCare security update for commons-configuration:commons-configuration (2 CVEs)","description":"TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1.","status":"withdrawn","published":"2026-09-14T05:20:46Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791878536","title":"TuxCare security update for commons-beanutils:commons-beanutils (3 CVEs)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 3 CVEs. Fixed in 1.9.3-tuxcare.1.","status":"published","published":"2026-10-13T08:02:16Z","modified":"2026-10-15T09:47:45.614213789Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792010669","title":"TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.0-tuxcare.2.","status":"published","published":"2026-10-14T20:44:29Z","modified":"2026-10-15T09:47:34.703980222Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793128163","title":"TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)","description":"TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-10-27T19:09:23Z","modified":"2026-10-28T01:45:02.461967765Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:49:03Z","modified":"2026-06-24T09:14:36.672909202Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:49:03.973Z","modified":"2026-10-14T19:47:23.684864921Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-57-1","title":"libstruts1.2-java - security update","status":"published","published":"2014-09-17T00:00:00Z","modified":"2026-03-09T02:10:12.119866Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-2940-1","title":"libstruts1.2-java - security update","status":"published","published":"2014-06-01T00:00:00Z","modified":"2026-03-09T01:21:10.3897Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-p66x-2cv9-qq3v","title":"Arbitrary code execution in Apache Commons BeanUtils","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2020-06-10T23:38:01Z","modified":"2024-12-01T05:31:59.449737Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"MGASA-2014-0219","title":"Updated struts packages fix CVE-2014-0114","description":"Updated struts packages fix security vulnerability:\n\nIt was found that the Struts 1 ActionForm object allowed access to the\n'class' parameter, which is directly mapped to the getClass() method. A\nremote attacker could use this flaw to manipulate the ClassLoader used by\nan application server running Struts 1. This could lead to remote code\nexecution under certain conditions (CVE-2014-0114).\n","status":"published","published":"2014-05-14T22:13:20Z","modified":"2026-04-16T06:22:23.237985728Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10617-1","title":"apache-commons-beanutils-1.9.4-3.7 on GA media","description":"These are all security issues fixed in the apache-commons-beanutils-1.9.4-3.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:39.590128Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2026:11105-1","title":"apache-commons-validator-1.10.1-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-validator-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:05.134846632Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"RHSA-2014:0474","title":"Red Hat Security Advisory: struts security update","status":"published","published":"2024-09-20T13:48:17Z","modified":"2026-10-13T10:01:11Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0500","title":"Red Hat Security Advisory: struts security update","status":"published","published":"2024-09-20T13:48:23Z","modified":"2026-10-13T10:01:12Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"ROOT-APP-MAVEN-CVE-2014-0114","title":"CVE-2014-0114 in commons-beanutils:commons-beanutils - Patched by Root","description":"Root has patched CVE-2014-0114 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-30T10:11:02Z","modified":"2026-09-30T11:15:03.901587108Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-RU-2015:0611-1","title":"Recommended update for SUSE Manager Server 2.1","description":"\nThis collective update for SUSE Manager Server 2.1 provides the following \nnew features:\n\n    * Connect SUSE Manager to the SUSE Customer Center.\n    * Manage SLE12 systems.\n    * ISS: export/import information about cloned channels to support\n      Service Pack migration on ISS slaves. (FATE#317789)\n    * New API calls: system.scheduleSPMigration(),\n      system.scheduleDistUpgrade(). (FATE#314785, FATE#314340)\n\nAdditionally, several issues have been fixed:\n\nauditlog-keeper:\n\n    * Fix value too long for type character varying(2048). (bnc#872351)\n    * Fix init.d script restart. (bsc#872029)\n\ncobbler:\n\n    * Require syslinux-x86_64 on s390x. (bsc#884051)\n    * Fix fetching of profiles for auto-installation. (bsc#880936)\n    * Fix port guessing in koan. (bsc#855389)\n    * Add 'copy-default' option to grubby-compat. (bsc#855389)\n    * Handle elilo in SUSE. (bsc#855389)\n    * Fix wrong option 'text' in SUSE environment. (bsc#901058)\n    * Fix re-installation on SLE with static network configuration.\n      (bsc#883487)\n    * Add RHEL 7 as a valid operating system version.\n\noracle-config:\n\n    * No need to pre-require Apache as its user and group are available in\n      the base system.\n\nosad:\n\n    * Enable and install osad during first installation. (bsc#901958)\n\npxe-default-image:\n\n    * Add bind-utils (dig) to packagelist. (bsc#889739)\n    * Wait for gateway to become available before register. (bsc#895001)\n\nrhnlib:\n\n    * Ensure bytes strings are sent to pyOpenSSL. (bnc#880388)\n\nrhnpush:\n\n    * Add default path structure to proxy lookaside that avoids collisions.\n\nsm-ncc-sync-data:\n\n    * Add SUSE Cloud 4 channels. (bnc#883057)\n    * Add channels for SUSE Manager Server 2.1 s390x.\n    * Fix parent label of the LTSS channel for SLMS.\n    * Add ATI and nVidia channels for SLED11-SP3. (bsc#901108)\n    * Add support for RES7 in SUSE Manager. (bsc#897723, bsc#893608)\n\nsmdba:\n\n    * Fix 'system check breaks backup and other configuration'.\n    * Implement rotating PostgreSQL backup. (bsc#896244)\n    * Space reclamation caused ORA-00942: table or view does not exist.\n      (bsc#906850)\n    * Archival of PosgreSQL transaction log does not recover in case of no\n      space left on device. (bsc#915140)\n\nspacecmd:\n\n    * Fix listupgrades. (bsc#892707)\n    * Make print_result a static method of SpacewalkShell. (bsc#889605)\n    * Call listAutoinstallableChannels() for listing distributions.\n      (bsc#887879)\n    * Fix spacecmd schedule listing. (bsc#902494)\n    * Fix call of setCustomOptions() during kickstart_importjson.\n      (bsc#879904)\n    * Fix configchannel export: do not create 'contents' key for\n      directories. (bsc#908849)\n\nspacewalk-backend:\n\n    * Insert update tag at the correct place for SLE12. (bsc#907677)\n    * Trigger generation of metadata if the repo contains no packages.\n      (bsc#870159)\n    * Convert mtime to localtime to prevent invalid times because of DST.\n      (bsc#914437)\n    * Do not exit with error if a vendor channel has no URL associated.\n      (bsc#914260)\n    * Convert empty string to null for DMI values. (bsc#911272)\n\nspacewalk-branding:\n\n    * CVE patches adapted for colour blind users. (bnc#872298)\n    * Underline in icons is removed. (bnc#880001)\n    * Fix link to macro documentation. (bsc#895961)\n    * Fix branding in error message. (bsc#902503)\n\nspacewalk-certs-tools:\n\n    * Fix removal of existing host key entries. (bsc#886391)\n    * Remove duplicates from authorized_keys2 as well. (bsc#885889)\n    * Do not allow registering a SUSE Manager server against itself.\n      (bsc#841731)\n\nspacewalk-client-tools:\n\n    * Allow unicode characters in proxy username and password.\n    * Send correct hostname. (bsc#887538)\n\nspacewalk-config:\n\n    * Add recommended Apache settings from the Security Team.\n\nspacewalk-java:\n\n    * Fix human dates now() staying unmodified. (bnc#880081)\n    * Allow for null evr and archs on event history detail. (bnc#880327)\n    * Disable form autocompletion in some places. (bnc#879998)\n    * Fix datepicker time at xx:xx PM pre-filled with xx:xx AM.\n      (bnc#881522)\n    * Fixed package upgrade via SSM when using the Oracle DB as backend.\n      (bnc#889721)\n    * This update fixes various cross-site scripting (XSS) issues in\n      spacewalk-java. (CVE-2014-3654, bnc#902182)\n    * Sync correct repositories. (bnc#904959)\n    * Fix pxt page link to point to the ported version of that page.\n      (bsc#903720)\n    * Correctly apply patches to multiple systems in SSM. (bsc#898242)\n    * Fix CVE audit when some packages of a patch are already installed.\n      (bsc#899266)\n    * Download CSV button does not export all columns ('Base Channel'\n      missing). (bsc#896238)\n    * Read and display only a limited number of logfile lines. (bsc#883009)\n    * Fix package upgrade via SSM. (bsc#889721)\n    * Fix logrotate for /var/log/rhn/rhn_web_api.log. (bsc#884081)\n    * Throw channel name exception if name is already used. (bnc#901675)\n    * Don't commit when XMLRPCExceptions are thrown. (bsc#908320)\n    * Remove 'Select All' button from system currency report. (bsc#653265)\n    * Fix documentation search. (bsc#875452)\n    * Add API listAutoinstallableChannels(). (bsc#887879)\n    * Avoid ArrayIndexOutOfBoundsException with invalid URLs. (bsc#892711)\n    * Avoid NumberFormatException in case of invalid URL. (bsc#892711)\n    * Lookup kickstart tree only when org is found. (bsc#892711)\n    * Fix NPE on GET /rhn/common/DownloadFile.do. (bsc#892711)\n    * Port of the advanced provisioning option page to bootstrap.\n      (bnc#862408)\n    * mgr-sync refresh sets wrong permissions on JSON files. (bnc#907337)\n    * Fix link to macro documentation. (bsc#895961)\n    * Forward to 'raw mode' page in case this is an uploaded profile.\n      (bsc#904841)\n    * Enlarge big text area to use more available screen space.\n      (bnc#867836)\n    * Fix links to monitoring documentation. (bsc#906887)\n    * Fix install type detection. (bsc#875231)\n    * Point 'Register Clients' link to 'Client Configuration Guide'.\n      (bsc#880026)\n    * Change order of installer type: prefer SUSE Linux. (bsc#860299)\n    * Fix ISE when clicking system currency. (bnc#905530)\n    * Set cobbler hostname variable when calling system.createSystemRecord.\n      (bnc#904699)\n    * Fix wrong install=http://nullnull line when calling\n      system.createSystemRecord. (bnc#904699)\n    * Explain snapshot/rollback behavior better. (bsc#808947)\n    * Fix patch syncing: prevent hibernate.NonUniqueObjectException\n      androllback. (bsc#903880)\n    * Remove 'Add Selected to SSM' from system overview page. (bsc#901776)\n    * Fix CVE audit in case of multi-version package installed and patch in\n      multi channels. (bsc#903723)\n    * Update channel family membership when channel is updated.\n      (bsc#901193)\n    * Add log warning if uploaded file size \u003e 1MB. (bnc#901927)\n    * Fix channel package compare. (bsc#904690)\n    * Fix automatic configuration file deployment via snippet. (bsc#898426)\n    * Add client hostname or IP to log messages. (bsc#904732)\n    * Fixed copying text from kickstart snippets. (bsc#880087)\n    * Fix auditlog config yaml syntax. (bsc#913221)\n    * Show Proxy tab if system is a proxy even when assigned to cloned\n      channels. (bsc#913939)\n    * Fixed uncaught error which prevent correct error handling.\n      (bsc#858971)\n    * Fix NPE by setting max_members to 0 instead of NULL. (bsc#912035)\n    * Fix more cross-site-scripting (XSS) issues. (CVE-2014-7811,\n      bsc#902915)\n    * Fix basic authentication for HTTP proxies. (bsc#912057)\n    * Accept repos with same SCC ID and different URLs. (bsc#911808)\n    * Avoid mgr-sync-refresh failure because clear_log_id was not called.\n      (bsc#911166)\n    * Fix cross-site-scripting (XSS) issue in system-group (CVE-2014-7812,\n      bsc#912886)\n    * Fix 'Select All' buttons display on rhn:list and make it consistent\n      with new rl:list. (bsc#909724)\n    * Fix List tag missing submit parameter for 'Select All' and others.\n      (bnc#909724)\n    * Sort filelist in configfile.compare event history alphabetically.\n      (bsc#910243)\n    * Allow parenthesis in system group description. (bsc#903064)\n    * Provide new API documentation in PDF format. (bsc#896029)\n    * Update the example scripts section. (bsc#896029)\n    * Fixed wording issues on package lock page. (bsc#880022)\n    * Make text more clear for package profile sync. (bsc#884350)\n\nspacewalk-reports:\n\n    * Added channel- and server-group-ids to activation-keys.\n    * Added spacewalk-report for systems with extra packages.\n\nspacewalk-search:\n\n    * Fix package searching in shared channels.\n\nspacewalk-setup:\n\n    * Setup /etc/sudoers in SUSE Manager upgrade scripts (bnc#881711)\n    * No activation if database population should be skipped. (bsc#900956)\n    * Do not enable spacewalk-service in runlevel 4. (bsc#879992)\n\nspacewalk-utils:\n\n    * Fixed spacewalk-hostname-rename to work with PostgreSQL backend.\n    * Added limitation of spacewalk-clone-by-date for RHEL4 and earlier.\n    * Add openSUSE 13.2 repositories to spacewalk-common-channels.\n    * Improve clone-by-date dependency resolution.\n    * Add CentOS 7 and EPEL 7 channels.\n    * Fix error if blacklist / removelist is not in scbd configurationfile.\n\nspacewalk-web:\n\n    * Fix links to monitoring documentation. (bsc#906887)\n    * Show Proxy tab if system is a proxy even when assigned to cloned\n      channels. (bsc#913939)\n\nsupportutils-plugin-susemanager:\n\n    * Write current service and repository configuration into\n      supportconfig.\n\nsusemanager-manuals_en, susemanager-jsp_en:\n\n    * Clarification about supported Web browsers. (bsc#889905)\n    * Update text and image files. (bnc#907527)\n    * Document NCC to SCC switch with SUSE Manager 2.1. (bnc#907106,\n      bnc#907643, bnc#907645, bnc#907646)\n    * SUSE Manager server update description. (bnc#902373)\n    * Activation keys and packages. (bnc#767279)\n    * Cobbler (bnc#880027), Link fix (bnc#881225), Wagon (bnc#884366)\n    * Install and ship the built PDFs. (bnc#907086)\n    * Update text and image files (bsc#910494).\n    * Firewall rules are incomplete - ssh-push and ssh-push-tunnel settings\n      missing. (bsc#904703)\n    * Document SP migration and ISS. (bsc#913215, partially).\n    * Fix 'beta packages' mentioned in documentation. (bsc#886421).\n    * User guide: Snapshots: clarify snaphot usage. (bsc#906851).\n    * Document maximal supported configuration file limit. (bsc#910482).\n\nsusemanager-schema:\n\n    * Add SLE 12 distribution targets to database.\n    * Fix evr_t schema upgrade. (bsc#881111)\n    * Allow evr_t to be compared with NULL in Oracle. (bsc#881111)\n    * Add support to ppc64le architecture.\n    * Fix migration script names to fix bare-metal registration.\n      (bsc#896109)\n    * Create regular index instead and have one migration per DB.\n      (bsc#905072)\n    * Drop unique index on package ids. (bsc#905072)\n    * Fix NPE by setting max_members to 0 instead of NULL. (bsc#912035)\n    * Fix old migration for future reference. (bsc#911180)\n    * Avoid NPE when migrating to SCC on Oracle migrated from 1.7.\n      (bsc#911180)\n\nsusemanager:\n\n    * Update the sudoers file after SUSE Manager upgrade. (bnc#881711)\n    * Fix oracle2postgres.sh (database configuration).\n    * Replace /etc/motd after setup. (bsc#883379)\n    * Make mgr-create-bootstrap-repo SCC and SLE 12 aware.\n    * Abort setup when invalid SSL country code given. (bnc#882468)\n    * Use noRepoSync parameter always.\n    * Fixed error message on exception in mgr-sync. (bnc#905263)\n    * Fixed add product to not trigger redundant addition of base channel.\n      (bnc#901928)\n    * Ask for the authentication beforehand. (bsc#908317)\n\nsusemanager-sync-data:\n\n    * Add channels for Public Cloud Module. (bsc#907586)\n    * Add new channel families SLE-WE and SLE-LP.\n    * Add ATI and nVidia channels for SLED11-SP3. (bsc#901108)\n    * Add channels for IBM-DLPAR for SLE12 ppc64le.\n    * Added support for RES7 in SUSE Manager. (bsc#897723, bsc#893608)\n\nsuseRegisterInfo:\n\n    * Re-add legacy suse_register_info to successfully perform the update.\n      (bsc#898428)\n\nzypp-plugin-spacewalk:\n\n    * Check for retrieveOnly option in up2date configuration and set\n      download_only. (bsc#896254)\n    * Changed the spec file to force usage of the official python VM.\n      (bsc#889363)\n\nyum:\n\n    * Preserve query parameters in URLs. (bsc#896844)\n\nstruts:\n\n    * CVE-2014-0114: The ActionForm object in Apache Struts 1.x through\n      1.3.10 allows remote attackers to 'manipulate' the ClassLoader and\n      execute arbitrary code via the class parameter, which is passed to\n      the getClass method.\n\napache2-mod_wsgi:\n\n    * CVE-2014-0242: Information exposure. (bnc#878553)\n    * CVE-2014-0240: Local privilege escalation. (bnc#878550)\n    * CVE-2014-8583: Failure to handle errors when attempting to drop group\n      privileges. (bnc#903961)\n\nlibyaml-0-2:\n\n    * Assert failure when processing wrapped strings (bnc#907809,\n      CVE-2014-9130)\n\ntanukiwrapper:\n\n    * Allow more than 4G as -Xmx option. (bsc#914900)\n\nThe following new packages have been added to the product: \nsusemanager-sync-data, google-gson, python-enum34.\n\nHow to apply this update:\n\n   1. Log in as root user to the SUSE Manager server.\n   2. Stop the Spacewalk service: spacewalk-service stop\n   3. Apply the patch using either zypper patch or YaST Online Update.\n   4. Upgrade the database schema with spacewalk-schema-upgrade\n   5. Start the Spacewalk service: spacewalk-service start\n\nSecurity Issues:\n\n    * CVE-2014-0114\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114\u003e\n    * CVE-2014-0240\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0240\u003e\n    * CVE-2014-0242\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0242\u003e\n    * CVE-2014-3654\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3654\u003e\n    * CVE-2014-7811\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7811\u003e\n    * CVE-2014-7812\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7812\u003e\n    * CVE-2014-8583\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8583\u003e\n    * CVE-2014-9130\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130\u003e\n\n","status":"published","published":"2015-02-25T20:05:05Z","modified":"2026-02-04T02:40:28.489451Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0886-1","title":"Security update for struts","description":"\nApache Struts was updated to fix a security issue:\n\n    * CVE-2014-0114: The ActionForm object in Apache Struts 1.x through\n      1.3.10 allows remote attackers to 'manipulate' the ClassLoader and\n      execute arbitrary code via the class parameter, which is passed to\n      the getClass method.\n\nSecurity Issue reference:\n\n    * CVE-2014-0114\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114\u003e\n\n","status":"published","published":"2014-06-20T20:43:07Z","modified":"2026-02-04T02:25:21.455929Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:02056-1","title":"Security update for apache-commons-beanutils","description":"This update for apache-commons-beanutils fixes the following issues:\n\nUpdate to 1.11.0:\n\n  * Fixed Bugs:\n\n    + BeanComparator.compare(T, T) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      all cases of ReflectiveOperationException.\n    + MappedMethodReference.get() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of\n      NoSuchMethodException.\n    + ResultSetIterator.get(String) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.hasNext() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.next() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.set(String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.set(String, String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n\n  * Changes:\n\n    + Add org.apache.commons.beanutils\n      .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.\n      Fixes bsc#1243793, CVE-2025-48734\n    + Bump org.apache.commons:commons-parent from 81 to 84.\n    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.\n\nUpdate to 1.10.1:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency\n      issue (backport to 1.X) #325.\n    + Javadoc is missing its Overview page.\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS (from\n      org.apache.commons:commons-parent:80).\n    + Deprecate BeanUtils.BeanUtils().\n    + Deprecate ConstructorUtils.ConstructorUtils().\n    + Deprecate LocaleBeanUtils.LocaleBeanUtils().\n    + Deprecate LocaleConvertUtils.LocaleConvertUtils().\n    + Deprecate ConvertUtils.ConvertUtils().\n    + Deprecate MethodUtils.MethodUtils().\n    + Deprecate PropertyUtils.PropertyUtils().\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 78 to 81.\n\nIncludes changes from 1.10.0:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches\n      corrupted writeMethod (1.x backport) #69.\n    + Replace internal use of Locale.ENGLISH with Locale.ROOT.\n    + Replace Maven CLIRR plugin with JApiCmp.\n    + Port to Java 1.4 Throwable APIs (!).\n    + Fix Javadoc generation on Java 8, 17, and 21.\n    + AbstractArrayConverter.parseElements(String) now returns a\n      List\u003cString\u003e instead of a raw List.\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 47 to 78.\n    + Bump Java requirement from Java 6 to 8.\n    + Bump junit:junit from 4.12 to 4.13.2.\n    + Bump JUnit from 4.x to 5.x 'vintage'.\n    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.\n    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n    + Deprecate BeanUtils.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n\nUpdate to 1.9.4:\n\n  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114\n\nUpdated to 1.9.3:\n\n  * This is a bug fix release, which also improves the tests for\n    building on Java 8.\n  * Note that Java 8 and later no longer support indexed bean\n    properties on java.util.List, only on arrays like String[].\t\n    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()\n    and PropertyUtils.getPropertyDescriptor(); their javadoc have\n    therefore been updated to reflect this change in the JDK.\n\n  * Changes in this version include:\n\n    - Fixed Bugs:\n\n      * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector\n      * BEANUTILS-492: Fixed exception when setting indexed properties\n          on DynaBeans.\n      * BEANUTILS-470: Precision lost when converting BigDecimal.\n      * BEANUTILS-465: Indexed List Setters fixed.\n\n    - Changes:\n\n      * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.\n      * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.\n      * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the\n      \tsame naming algorithm as DefaultBeanIntrospector.\n      * BEANUTILS-490: Update Java requirement from Java 5 to 6.\n      * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2\n        (CVE-2015-4852).\n      * BEANUTILS-490: Update java requirement to Java 6.\n      * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.\n      * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.\n      * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.\n    - Historical list of changes:\n      http://commons.apache.org/proper/commons-beanutils/changes-report.html\n\n","status":"published","published":"2025-06-20T16:17:22Z","modified":"2026-02-04T02:16:19.881198Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"UBUNTU-CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","status":"published","published":"2014-04-30T10:49:00Z","modified":"2026-02-04T03:17:45.981797Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-4766-1","title":"commons-beanutils vulnerabilities","description":"It was discovered that Apache Commons BeanUtils improperly handled certain\ninput. An attacker could possibly use this vulnerability to cause a crash or execute arbitrary code.\n","status":"published","published":"2021-03-15T20:06:47Z","modified":"2026-06-29T13:48:11.688688824Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-8322-2","title":"commons-beanutils regression","description":"USN-8322-1 fixed a vulnerability in Apache Commons BeanUtils. It was\ndiscovered that for Ubuntu 18.04 LTS, during the update preparation\nphase, a previous fix for CVE-2014-0114 and CVE-2019-10086 was\nincorrectly dropped. This update reintroduces the fix for\nCVE-2014-0114 and CVE-2019-10086.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Apache Commons BeanUtils incorrectly allowed\n access to the declaredClass property of Java enum objects when handling\n externally supplied property paths. An attacker could possibly use this\n issue to execute arbitrary code.","status":"published","published":"2026-07-23T10:39:20Z","modified":"2026-07-23T20:58:20.458328977Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}