CVE-2014-0112: Apache Struts

High severity, CVSS 7.5. EPSS: 98.1% chance of exploitation in the next 30 days.

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

Affected products

• Apache Struts: from 2.0.0, before 2.3.16.2 (fixed in 2.3.16.2)

Published 2014-04-29. Last modified 2026-06-17.