GHSA-vrwc-qjmw-5rjm

Source

https://github.com/advisories/GHSA-vrwc-qjmw-5rjm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrwc-qjmw-5rjm/GHSA-vrwc-qjmw-5rjm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrwc-qjmw-5rjm

Aliases

CVE-2014-0094

Published

2022-05-14T00:54:15Z

Modified

2024-12-06T05:29:45.096096Z

Summary

ClassLoader manipulation in Apache Struts

Details

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

Database specific

{
    "github_reviewed_at": "2022-11-03T22:54:35Z",
    "cwe_ids": [],
    "nvd_published_at": "2014-03-11T13:00:00Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.3.16.2

Affected versions

2.*

2.0.5

2.0.6

2.0.8

2.0.9

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.14

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

2.2.3

2.2.3.1

2.3.1

2.3.1.1

2.3.1.2

2.3.3

2.3.4

2.3.4.1

2.3.7

2.3.8

2.3.12

2.3.14

2.3.14.1

2.3.14.2

2.3.14.3

2.3.15

2.3.15.1

2.3.15.2

2.3.15.3

2.3.16

2.3.16.1

Maven / org.apache.struts.xwork:xwork-core