PT-2014-1441 · Apache+1 · Apache Struts+1

Zubair Ashraf · Published 2014-05-06 · Updated 2022-05-14 · CVE-2014-0116

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.20

Description The issue is related to the CookieInterceptor in Apache Struts, where an incomplete fix for a previous issue leads to improper access restriction to the getClass method when a wildcard cookiesName value is used. This allows remote attackers to manipulate the ClassLoader and modify session state via a crafted request. The vulnerability can be exploited by sending a specially crafted request, potentially allowing attackers to read, modify, or delete data.

Recommendations For versions prior to 2.3.20, update to version 2.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the getClass method of the CookieInterceptor class until a patch is available. Avoid using wildcard values for the cookiesName parameter in the affected API endpoints until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00403

CVE-2014-0116

GHSA-HMHQ-382Q-MP56

Affected Products

Apache Struts

Huawei Vrp

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2014-0116 · Security Note
• https://osv.dev/vulnerability/GHSA-hmhq-382q-mp56 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00403 · Security Note
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/1a668af7f1ffccea4a3b46d8d8c1fe1c7331ff02 · Note
• https://ibm.com/support/pages/security-bulletin-ibm-platform-symphony-cve-2014-0094-cve-2014-0112-cve-2014-0113-cve-2014-0116 · Note
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm · Note
• https://oracle.com/security-alerts/cpuapr2015.html · Note
• http://struts.apache.org/release/2.3.x/docs/s2-022.html · Note
• http://securityfocus.com/bid/67218 · Note
• http://oracle.com/technetwork/topics/security/cpuapr2015-2365600.html · Note
• http://secunia.com/advisories/59816 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note