CVE-2014-0114

High

Published: 30/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.

Risk Assessment

Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to upgrade to the latest version of Apache Commons BeanUtils and review application code to eliminate the possibility of ClassLoader manipulation.

Other vulnerabilities in Apache Commons BeanUtils

CVE-2019-10086High
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. However, this was not used by default by PropertyUtilsBean.

Original NVD description (English source)

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.