ClassLoader manipulation in Apache Struts
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0094US | medium5.0 | Exploit | ||
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. | ||||
02
references
External citations — patches, advisories, analysis.
- http://jvn.jp/en/jp/JVN19294237/index.htmlWEB
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045WEB
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlWEB
- http://struts.apache.org/release/2.3.x/docs/s2-020.htmlWEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706WEB
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htmWEB
- http://www.konakart.com/downloads/ver-7-3-0-0-whats-newWEB
- http://www.vmware.com/security/advisories/VMSA-2014-0007.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan