CVE-2014-0113: Apache Struts CookieInterceptor wildcard ClassLoader code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a high EPSS score and a known patch, though not listed in KEV.

What it is

CookieInterceptor in Apache Struts before 2.3.20 fails to restrict access to the getClass method when a wildcard cookiesName value is configured, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. It is an incomplete fix for CVE-2014-0094, so the earlier patch does not fully close the underlying access-control gap.

Impact

An unauthenticated remote attacker can manipulate the ClassLoader and execute arbitrary code in the context of the Struts application, potentially leading to full server compromise.

Attack surface

Reachable over the network via HTTP requests to a Struts application that uses a wildcard cookiesName value; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high (0.7783, 99.5th percentile), and the vendor advisory is tagged Patch, indicating a fix is available but exploitation is plausible.

What to do

• Upgrade Apache Struts to 2.3.20 or later, which contains the complete fix for CVE-2014-0094 and this bypass.
• Avoid wildcard cookiesName values in CookieInterceptor configuration; use explicit, minimal cookie name lists.
• Apply vendor patches for downstream products (IBM, Oracle) that bundle affected Struts versions.
• If immediate upgrade is not possible, restrict or block untrusted HTTP requests that attempt to reach CookieInterceptor-exposed parameters.
• Review and harden Struts configuration to limit exposure of internal class and ClassLoader methods.

Detection

• Monitor HTTP requests for parameters or cookie names that reference getClass or ClassLoader patterns.
• Alert on anomalous cookie handling in Struts applications, especially requests with unexpected wildcard-matched cookie names.
• Correlate web logs with process or file-integrity events that indicate code execution following suspicious requests.
• Track Struts versions in use and flag any instance below 2.3.20 for remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.