CVE-2014-0116 (Medium) detected in struts2-core-2.3.1.2.jar

[mend-for-github-com]

CVE-2014-0116 - Medium Severity Vulnerability

Vulnerable Library - struts2-core-2.3.1.2.jar

Apache Struts 2

Path to dependency file: /tmp/ws-scm/Struts2Example/pom.xml

Path to vulnerable library: 20200325141938/downloadResource_d50070f4-1279-48e5-8366-a2fcdc735d7c/20200325145151/struts2-core-2.3.1.2.jar

Dependency Hierarchy:

• ❌ struts2-core-2.3.1.2.jar (Vulnerable Library)

Found in HEAD commit: 20d7b6df1b42979ec0033b63405d552a70d92b0c

Vulnerability Details

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

Publish Date: 2014-05-08

URL: CVE-2014-0116

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-0116

Release Date: 2014-05-08

Fix Resolution: 2.3.16.3

---

• Check this box to open an automated fix PR