Patchfirst
Patchfirst
CVE-2014-0113 Public exploit EPSS 78.3%

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly…

Official description · CVE.org

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Breakdown
59.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 8 years after disclosure. Public exploit code (Exploit-DB) appeared 3 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codeExploit-DB+3 days
  3. First seen exploitedVulnCheck KEV evidence+8 yrs

See the family tree

A fix was bypassed or incomplete 3 times over 4 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2012-0393The ParameterInterceptor component in Apache Struts before…8 Jan 2012
  2. same family
    CVE-2012-0394The DebuggingInterceptor component in Apache Struts before…8 Jan 2012
  3. relatedMedium

    Why these are linked:

    CVE-2012-4387Struts 2.0.0 through 2.3.4 allows remote attackers to cause a…5 Sep 2012
  4. relatedMedium

    Why these are linked:

    CVE-2014-0094The ParametersInterceptor in Apache Struts before 2.3.16.2…10 Mar 2014
  5. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does not…29 Apr 2014
  6. same family
    This CVECVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a…29 Apr 2014
  7. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…8 May 2014
  8. same family
    CVE-2015-1831The default exclude patterns (excludeParams) in Apache Struts…16 Jul 2015

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-3c5c-xrq4-qhr8

Upgrade to 2.5.33

Fixes this CVE and 23 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +21).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.3.20 for CVE-2014-0113.

Affected versions

If you runUpgrade to
All versions before 2.3.202.5.33first fix for this CVE: 2.3.20

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

x_refsource_CONFIRM 3

cwiki.apache.org/confluence/display/WW/S2-021oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlwww-01.ibm.com/support/docview.wss?uid=swg21676706

third-party-advisory 1

secunia.com/advisories/59178

mailing-list 1

securityfocus.com/archive/1/531952/100/0/threaded
↑ ↓ chooseEnter openEsc close