exploit/multi/http/struts_code_exec_classloader
PoCApache Struts ClassLoader Manipulation Remote Code Execution
01
exploited CVEs (3)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0114US | high7.5 | Exploit | ||
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, doe… | ||||
| CVE-2014-0112US | high7.5 | Exploit | ||
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and exe… | ||||
| CVE-2014-0094US | medium5.0 | Exploit | ||
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan