AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2014-0116

MEDIUM · CVSS 5.8 EPSS 6.52%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2014-05-08 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2014-0116
Severity
MEDIUM
CVSS
5.8
EPSS
6.52%
Apache

Original NVD Description

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.