CVE-2014-0116

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method…

published May 8, 2014

CVSS
—
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06569 · 93.8th percentile
Published
2014-05-08T10:00Z
EPSS history
Timeline
  • 08 MAY 10:00Z
    CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method…
    cvelistv5