CVE-2014-0114
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils throu…
Published Apr 30, 2014 · updated Oct 14, 2026 · apache commons beanutils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Timeline
Detection, updates, and resolution for this record.
Apr 30, 2014 · NIST NVD
Detected
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method
Oct 14, 2026 · NIST NVD
Updated
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method
Affected
- cpe apache/commons beanutilsversion unspecified
- cpe apache/struts1.0
- cpe apache/struts1.0.2
- cpe apache/struts1.1
Sources
- CVE.orgCVE-2014-0114
Official CVE identifier
cve.org - FIRST EPSSCVE-2014-0114
30-day exploitation probability 99.0%
first.org - Exploit Database41690
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/struts_code_exec_classloader
Public module reference (manual). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2014-0114
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and
nvd.nist.gov