Vulnerability record · CVE-2014-0112 · published 29 April 2014
CVE-2014-0112: Apache Struts ParametersInterceptor access control bypass enables remote code execution
Apache · Struts
ParametersInterceptor in Apache Struts before 2.3.20 fails to properly restrict access to the getClass method, letting a crafted request manipulate the ClassLoader and execute arbitrary code. The flaw is an incomplete fix for CVE-2014-0094, so systems patched only for that earlier issue remain exposed. It matters because Struts is widely deployed and the attack is network-reachable without credentials.
Description
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityNetwork-reachable unauthenticated remote code execution with a very high EPSS score, though no KEV listing or confirmed in-the-wild reporting is provided.
What it is
ParametersInterceptor in Apache Struts before 2.3.20 fails to properly restrict access to the getClass method, letting a crafted request manipulate the ClassLoader and execute arbitrary code. The flaw is an incomplete fix for CVE-2014-0094, so systems patched only for that earlier issue remain exposed. It matters because Struts is widely deployed and the attack is network-reachable without credentials.
Impact
A remote attacker can execute arbitrary code in the context of the application server, leading to full compromise of the affected host or application.
Attack surface
Reached over the network via crafted HTTP requests to a Struts application that processes parameters through ParametersInterceptor. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.979 probability, 0.999 percentile), indicating strong likelihood of exploitation activity. Reference tags are advisory and patch links only, with no public exploit tag supplied.
What to do
- Upgrade Apache Struts to 2.3.20 or later, which contains the complete fix for CVE-2014-0094 and this bypass.
- If immediate upgrade is not possible, apply the S2-021 vendor guidance and any interim configuration restrictions on parameter handling.
- Inventory applications and embedded frameworks using Struts to find instances still on versions before 2.3.20, including third-party products that bundle it.
- Restrict network exposure of Struts-based applications and place them behind authentication or a WAF where feasible.
- Monitor vendor advisories for downstream products (for example Oracle, IBM, VMware, Red Hat) that shipped affected Struts versions.
Detection
- Inspect HTTP requests for parameter names or values referencing getClass, class.classloader, or similar class-loading constructs.
- Alert on unexpected outbound connections or process creation from the Java application server hosting Struts.
- Review web and application logs for anomalous parameter patterns or errors tied to ParametersInterceptor.
- Correlate Struts version fingerprints in responses or build manifests against the 2.3.20 threshold.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-0112 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-0112), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
