Get real-time updates on Telegram
CVE-2014-0114: commons beanutils through 1.9.1 (inclusive); +2 more affected products
CVE-2014-0114. CVSS 2.0 base score 7.5 (HIGH, NVD). EPSS 0.99032 (percentile 0.99931), scored 13-Oct-2026.
Affected technology
commons beanutils · through 1.9.1 (inclusive)
apache
struts · 1.0
apache
struts · 1.0.2
apache
struts · 1.1
apache
struts · 1.1 · update b1
apache
struts · 1.1 · update b2
apache
struts · 1.1 · update b3
apache
struts · 1.1 · update rc1
apache
struts · 1.1 · update rc2
apache
struts · 1.2.2
apache
struts · 1.2.4
apache
struts · 1.2.6
apache
struts · 1.2.7
apache
struts · 1.2.8
apache
struts · 1.2.9
apache
struts · 1.3.5
apache
struts · 1.3.8
apache
struts · 1.3.10
apache
n/a · n/a
Vendor not specified by the source
Component: Not specified by the source
Attack conditions (NVD, CVSS 2.0): Network (remote)
What an attacker can do
Remote attackers can "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. NVD’s CVSS 2.0 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as partial.
- CWE
- CWE-20
- CCR priority
- 54.8 /100 (P3)
- CVSS 2.0
- 7.5 /10 · CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P · NVD
- EPSS
- 0.99032 · percentile 0.99931 · 2026-10-13
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2014-0114.html