VDB
GSD-2014-0114
GSD-2014-0114
PUBLISHED
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
Timeline
- Mar 7, 2011 CVE Published
- Mar 6, 2014 PoC Published
- Sep 6, 2015 PoC Published
- Feb 14, 2016 PoC Published
- May 29, 2018 PoC Published
- Feb 6, 2025 PoC Published
- Feb 23, 2025 PoC Published
- Aug 31, 2025 PoC Published
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Security Advisory
References
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html url
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html url
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html url
- http://www-01.ibm.com/support/docview.wss?uid=swg21675689 url
- FEDORA-2014-9380 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21674812 url
- 59118 third-party-advisory
- https://security.netapp.com/advisory/ntap-20180629-0006/ url
- http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt url
- 60703 third-party-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 url
- http://www-01.ibm.com/support/docview.wss?uid=swg21676375 url
- HPSBST03160 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21675898 url
- 59246 third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html url
- http://www-01.ibm.com/support/docview.wss?uid=swg21674128 url
- http://www-01.ibm.com/support/docview.wss?uid=swg21676931 url
- http://www.ibm.com/support/docview.wss?uid=swg21675496 url
- 59014 third-party-advisory
…and 99 more