Versions Compared

Old Version 13

changes.mady.by.user René Gielen

Saved on

compared with

New Version Current

changes.mady.by.user Lukasz Lenart

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Who should read this

All Struts 2 developers and users

Impact of vulnerability

ClassLoader manipulation

Maximum security rating

HighImportant

Recommendation

Developers should immediately upgrade to Struts 2.3.20

Affected Software

Struts 2.0.0 - Struts 2.3.16.3

Reporter

NTT-CERT via JPCERT/CC,
Takeshi Terada (Mitsui Bussan Secure Directions, Inc.),
Takayoshi Isayama (Mitsui Bussan Secure Directions, Inc.),
Yoshiyuki Karezaki (Yoshiyuki.Karezaki at scsk.jp)
BAKA/ty (121605589 at qq.com),
Nebula (Chibi, Hubei, CN), HelloWorld security team,
NSFOCUS Security Team,
heige (zhoujp at knownsec.com)

CVE Identifier

CVE-2014-0112 - Incomplete fix for ClassLoader manipulation via ParametersInterceptor

CVE-2014-0113 - ClassLoader manipulation via CookieInterceptor when configured to accept all cookies

...