Lucene search

K

[email protected]NVD:CVE-2014-0116

HistoryMay 08, 2014 - 10:55 a.m.

CVE-2014-0116

2014-05-0810:55:02

CWE-264

[email protected]

web.nvd.nist.gov

1

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

9.3 High

AI Score

Confidence

High

0.969 High

EPSS

Percentile

99.7%

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to “manipulate” the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

Affected configurations

NVD

Node

apachestrutsMatch2.0.0

OR

apachestrutsMatch2.0.1

OR

apachestrutsMatch2.0.2

OR

apachestrutsMatch2.0.3

OR

apachestrutsMatch2.0.4

OR

apachestrutsMatch2.0.5

OR

apachestrutsMatch2.0.6

OR

apachestrutsMatch2.0.7

OR

apachestrutsMatch2.0.8

OR

apachestrutsMatch2.0.9

OR

apachestrutsMatch2.0.10

OR

apachestrutsMatch2.0.11

OR

apachestrutsMatch2.0.11.1

OR

apachestrutsMatch2.0.11.2

OR

apachestrutsMatch2.0.12

OR

apachestrutsMatch2.0.13

OR

apachestrutsMatch2.0.14

OR

apachestrutsMatch2.1.0

OR

apachestrutsMatch2.1.1

OR

apachestrutsMatch2.1.2

OR

apachestrutsMatch2.1.3

OR

apachestrutsMatch2.1.4

OR

apachestrutsMatch2.1.5

OR

apachestrutsMatch2.1.6

OR

apachestrutsMatch2.1.8

OR

apachestrutsMatch2.1.8.1

OR

apachestrutsMatch2.2.1

OR

apachestrutsMatch2.2.1.1

OR

apachestrutsMatch2.2.3

OR

apachestrutsMatch2.2.3.1

OR

apachestrutsMatch2.3.1

OR

apachestrutsMatch2.3.1.1

OR

apachestrutsMatch2.3.1.2

OR

apachestrutsMatch2.3.3

OR

apachestrutsMatch2.3.4

OR

apachestrutsMatch2.3.4.1

OR

apachestrutsMatch2.3.7

OR

apachestrutsMatch2.3.8

OR

apachestrutsMatch2.3.12

OR

apachestrutsMatch2.3.14

OR

apachestrutsMatch2.3.14.1

OR

apachestrutsMatch2.3.14.2

OR

apachestrutsMatch2.3.14.3

OR

apachestrutsMatch2.3.15

OR

apachestrutsMatch2.3.15.1

OR

apachestrutsMatch2.3.15.2

OR

apachestrutsMatch2.3.15.3

OR

apachestrutsMatch2.3.16

OR

apachestrutsMatch2.3.16.1

OR

apachestrutsMatch2.3.16.2

References

secunia.com/advisories/59816

struts.apache.org/release/2.3.x/docs/s2-022.html

www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm

www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

www.securityfocus.com/bid/67218

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

9.3 High

AI Score

Confidence

High

0.969 High

EPSS

Percentile

99.7%

Related for NVD:CVE-2014-0116

github2 osv2 cve2 prion2 ubuntucve2 cvelist2 ibm5 nessus5 f55 openvas2 nvd1 veracode1 huawei1 checkpoint_advisories1 oracle1