CVE-2014-0116

Publication date 8 May 2014

Last updated 24 July 2024

Ubuntu priority

Description

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libstruts1.2-java	14.04 LTS trusty	Not in release
	13.10 saucy	Not affected
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not affected

How can I get the fixes?
What do statuses mean?

Notes

jdstrand

per Debian: <not-affected> (Struts 2.0.0 through to Struts 2.3.16.2)

References

MITRE
NVD
Launchpad
Debian

Other references

https://cwiki.apache.org/confluence/display/WW/S2-022
http://struts.apache.org/release/2.3.x/docs/s2-022.html
https://www.cve.org/CVERecord?id=CVE-2014-0116