CVE-2014-0114
- State
- Published
- Severity
- Not scored
- Published
- Apr 30, 2014
- Updated
- Oct 14, 2026
- Reserved
- Dec 3, 2013
Description
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [apache-ignite-developers] 20180601 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114mailing-list
- 57477third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html
- https://issues.apache.org/jira/browse/BEANUTILS-463
- 58710third-party-advisory
- MDVSA-2014:095vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21675689
- FEDORA-2014-9380vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21674812
- https://security.netapp.com/advisory/ntap-20140911-0001/
- 59464third-party-advisory
- 59118third-party-advisory
- https://security.netapp.com/advisory/ntap-20180629-0006/
- http://www-01.ibm.com/support/docview.wss?uid=swg21675387
- https://access.redhat.com/solutions/869353
- https://bugzilla.redhat.com/show_bug.cgi?id=1091938
- http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt
- http://advisories.mageia.org/MGASA-2014-0219.html
- 60703third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21675972
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- http://www-01.ibm.com/support/docview.wss?uid=swg21676375
- [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCEmailing-list
- RHSA-2018:2669vendor-advisory
- GLSA-201607-09vendor-advisory
- HPSBST03160vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesmailing-list
- http://www-01.ibm.com/support/docview.wss?uid=swg21675898
- http://www-01.ibm.com/support/docview.wss?uid=swg21676110
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www-01.ibm.com/support/docview.wss?uid=swg27042296
- http://www-01.ibm.com/support/docview.wss?uid=swg21676303
- 59228third-party-advisory
- 59246third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1116665
- [oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCEmailing-list
- 59245third-party-advisory
- HPSBMU03090vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21674128
- http://www-01.ibm.com/support/docview.wss?uid=swg21676931
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- 60177third-party-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesmailing-list
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.ibm.com/support/docview.wss?uid=swg21675496
- DSA-2940vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21675266
- 59014third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21677110
- http://www-01.ibm.com/support/docview.wss?uid=swg21676091
- 67121vdb-entry
- 59480third-party-advisory
- HPSBGN03041vendor-advisory
- 59479third-party-advisory
- 59704third-party-advisory
- 58947third-party-advisory
- 59718third-party-advisory
- 59430third-party-advisory
- 58851third-party-advisory
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Reportmailing-list
- [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilitiesmailing-list
- [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilitiesmailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- [commons-issues] 20190521 [jira] [Created] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [commons-issues] 20190522 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E
- [commons-issues] 20190522 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E
- [commons-dev] 20190522 [beanutils2] CVE-2014-0114 Pull Requestmailing-list
- https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E
- [commons-dev] 20190525 Re: [beanutils2] CVE-2014-0114 Pull Requestmailing-list
- https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E
- [commons-commits] 20190528 [commons-beanutils] branch master updated: BEANUTILS-520: Mitigate CVE-2014-0114 by enabling SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS by default. (#7)mailing-list
- [commons-issues] 20190528 [jira] [Closed] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #74mailing-list
- [commons-commits] 20190528 [commons-beanutils] branch master updated: [BEANUTILS-520] BeanUtils2 mitigate CVE-2014-0114.mailing-list
- [commons-issues] 20190528 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #75mailing-list
- [commons-dev] 20190605 Re: [beanutils] Towards 1.10mailing-list
- https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E
- [commons-issues] 20190615 [jira] [Updated] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [commons-issues] 20190615 [jira] [Reopened] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [commons-issues] 20190615 [jira] [Resolved] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E
- [commons-dev] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.mailing-list
- [commons-user] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.mailing-list
- [announce] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.mailing-list
- [commons-issues] 20190818 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114mailing-list
- [activemq-gitbox] 20190903 [GitHub] [activemq-artemis] jeloba opened a new pull request #2820: Updated Apache BeanUtils to address CVEmailing-list
- [activemq-issues] 20190904 [jira] [Created] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114mailing-list
- [commons-commits] 20190906 [commons-configuration] branch master updated: [CONFIGURATION-755][CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.mailing-list
- [commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.mailing-list
- [commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.mailing-list
- [activemq-issues] 20190909 [jira] [Work logged] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114mailing-list
- https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E
- RHSA-2019:2995vendor-advisory
- [commons-issues] 20191014 [jira] [Updated] (BEANUTILS-520) Mitigate CVE-2014-0114mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilitiesmailing-list
- [activemq-issues] 20200109 [jira] [Resolved] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1mailing-list
- [lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1mailing-list
- [dolphinscheduler-commits] 20210121 [GitHub] [incubator-dolphinscheduler] c-f-cooper commented on issue #4506: There is a vulnerability in beanutils 1.7.0,upgrade recommendedmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.