EDB-33142
functionalApache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
view exploit source exploit_dbverifiedtype remoteauthor Metasploitpublished 2014-05-02catalog exploit_db
01
exploited CVEs (3)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0113US | high7.5 | Exploit | ||
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers… | ||||
| CVE-2014-0112US | high7.5 | Exploit | ||
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and exe… | ||||
| CVE-2014-0094US | medium5.0 | Exploit | ||
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan