Vulnerability record · CVE-2014-0114 · published 30 April 2014
CVE-2014-0114: Apache Commons BeanUtils class property allows remote code execution
Apache · Commons Beanutils
Apache Commons BeanUtils through 1.9.2 fails to suppress the class property, so an attacker can manipulate the ClassLoader through a class parameter. This affects BeanUtils as bundled in Apache Struts 1.x through 1.3.10 and other products using commons-beanutils. Because the flaw enables arbitrary code execution on the server, it is a serious risk for any application exposing the vulnerable parameter.
Description
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a very high EPSS score, though not confirmed in KEV or with public exploit tags.
What it is
Apache Commons BeanUtils through 1.9.2 fails to suppress the class property, so an attacker can manipulate the ClassLoader through a class parameter. This affects BeanUtils as bundled in Apache Struts 1.x through 1.3.10 and other products using commons-beanutils. Because the flaw enables arbitrary code execution on the server, it is a serious risk for any application exposing the vulnerable parameter.
Impact
An attacker can manipulate the ClassLoader and execute arbitrary code in the context of the affected application. This typically yields full compromise of the application server and any data or credentials it can reach.
Attack surface
Reachable remotely over the network with no authentication required, per the CVSS vector AV:N/AC:L/Au:N. The description demonstrates the attack by passing a crafted class parameter to the getClass method of the ActionForm object in Struts 1, so any endpoint that binds request parameters to such objects is exposed.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is very high at 0.9895 (99.9th percentile), indicating strong likelihood of exploitation activity. The record does not confirm public exploit code or in-the-wild use.
What to do
- Upgrade Apache Commons BeanUtils to a fixed release (1.9.2 or later per the release notes) and update any bundled copies in Struts 1 and other dependent products.
- Upgrade or retire Apache Struts 1.x deployments, which are end-of-life and bundle the vulnerable library.
- Apply vendor patches from distributions that shipped commons-beanutils (for example Fedora and Mageia advisories referenced in the record).
- Add input validation or a filter that rejects request parameters named class before they reach bean binding.
- Inventory applications for commons-beanutils versions below the fixed release and prioritize internet-facing ones.
Detection
- Search application and server logs for request parameters named class, especially values referencing ClassLoader or java.lang.Class.
- Monitor for unexpected child processes or outbound connections spawned by the Java application server.
- Scan deployed artifacts for commons-beanutils jar versions below the fixed release and flag Struts 1.x usage.
- Alert on WAF or proxy hits containing class= parameters in request bodies or query strings.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-0114 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-0114), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.
