PT-2014-2051 · Apache · Apache Struts
Publicado
2014-03-06
·
Atualizado
2022-05-14
·
CVE-2014-0094
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Struts versions prior to 2.3.16.2
Description
The issue is related to the ParametersInterceptor in Apache Struts, which allows remote attackers to manipulate the ClassLoader via the
class parameter passed to the getClass method. This is due to insufficient input validation, enabling a remote attacker to impact the integrity of protected information using the class parameter.Recommendations
For versions prior to 2.3.16.2, update to version 2.3.16.2 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
getClass method or validating the class parameter to minimize the risk of exploitation.Exploit
Correção
RCE
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Struts