ParametersInterceptor in Apache Struts prior to 2.3.20 does not properly restrict access to the getClass method, which allows remote malicious users to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
apache struts |