Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2019 CPU advisory.

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Xalan)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Knowledge accessible data as well as unauthorized read access     to a subset of Oracle Knowledge accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Knowledge. (CVE-2014-0107)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons BeanUtils)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and     8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2014-0114)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Derby)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Knowledge accessible data and unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Knowledge. (CVE-2015-1832)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (JGroups)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge.
    (CVE-2016-2141)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons FileUpload)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0     and 8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2016-1000031)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications     (InfoCenter)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Knowledge, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Knowledge accessible data as well as unauthorized read access to a subset of Oracle     Knowledge accessible data. (CVE-2019-2719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4766-1 advisory.

    It was discovered that Apache Commons BeanUtils improperly handled certain input. An attacker could     possibly use this vulnerability to cause a crash or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x through 7.0.0.45, 8.0.0.x through 8.0.0.15, 8.5.0.x prior to 8.5.5.14 or 9.0.x prior to 9.0.0.9. It is, therefore, affected by multiple vulnerabilities related to Apache Struts, including the following:

  - Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through     1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class     property, which allows remote attackers to manipulate the ClassLoader and execute arbitrary code via the     class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm     object in Struts 1. (CVE-2014-0114)

  - ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm     instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected     memory access) via a multipart request, a related issue to CVE-2015-0899. (CVE-2016-1181)

  - ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator     configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a     denial of service via crafted input, a related issue to CVE-2015-0899. (CVE-2016-1182)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.33.  Such versions are potentially affected by multiple vulnerabilities :

 - A cross-site scripting (XSS) flaw exists within the Administration Console, where user input is improperly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6323, PI04777, PI04880)
 - A denial of service flaw exists within the Global Security Kit when handling SSLv2 resumption during the SSL/TLS handshake.  This could allow a remote attacker to crash the program. (CVE-2013-6329, PI05309)
 - A buffer overflow flaw exists in the HTTP server with the 'mod_dav' module when using add-ons.  This could allow a remote attacker to cause a buffer overflow and a denial of service. (CVE-2013-6438, PI09345)
 - An XSS flaw exists within 'OAuth' where user input is not properly validated.  This could allow a remote attacker, with a specially crafted request, to execute arbitrary script code within the browser/server trust relationship. (CVE-2013-6738, PI05661)
 - A denial of service (DoS) flaw exists within the Global Security Kit when handling the X.509 certificate chain during the initiation of an SSL/TLS connection.  A remote attacker, using a malformed certificate chain, could cause the client or server to crash by hanging the Global Security Kit. (CVE-2013-6747, PI09443)
 - A DoS flaw exists within the Apache Commons 'FileUpload' when parsing a content-type header for a multipart request.  A remote attacker, using a specially crafted request, could crash the program. (CVE-2014-0050, PI12648, PI12926 and PI13162)
 - A DoS flaw exists in the 'mod_log_config' when logging a cookie with an unassigned value.  A remote attacker, using a specially crafted request, can cause the program to crash. (CVE-2014-0098, PI13028)
 - A remote code execution flaw exists with Apache Struts.  The failure to restrict setting of class loader attributes could allow a remote attacker to execute arbitrary script code. (CVE-2014-0114, PI17190)
 - An information disclosure flaw exists in the 'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.  This many allow a remote attacker to gain timing information intended to be protected by encryption. (CVE-2014-0453)
 - A flaw exists within 'com.sun.jndi.dns.DnsClient' related to the randomization of query IDs. This could  allow a remote attacker to conduct spoofing attacks. (CVE-2014-0460)
 - A DoS flaw exists in a web server plugin on servers configured to retry failed POST requests.  This could allow a remote attacker to crash the application. (CVE-2014-0859, PI08892)
 - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom' cryptographic providers by generating numbers in a predictable manner.  This could allow a remote attacker to easily guess the output of the random number generator. (CVE-2014-0878)
 - An information disclosure flaw exists within Proxy and ODR servers.  This could allow a remote attacker, using a specially crafted request, to gain access to potentially sensitive information. (CVE-2014-0891, PI09786)
 - A DoS flaw exists within the IBM Security Access Manager for Web with the Reverse Proxy component.  This could allow a remote attacker, using specially crafted TLS traffic, to cause the application on the system to become unresponsive. (CVE-2014-0963, PI17025)
 - An information disclosure flaw exists when handling SOAP responses.  This could allow a remote attacker to potentially gain access to sensitive information. (CVE-2014-0965, PI11434)
 - An information disclosure flaw exists.  A remote attacker, using a specially crafted URL, could gain access to potentially sensitive information. (CVE-2014-3022, PI09594)
 - An unspecified flaw exists that may allow an attacker to gain elevated privileges.  No further details have been provided.

The remote host is affected by the vulnerability described in GLSA-201607-09 (Commons-BeanUtils: Arbitrary code execution)

    Apache Commons BeanUtils does not suppress the class property, which       allows for the manipulation of the ClassLoader.
  Impact :

    Remote attackers could potentially execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

It was discovered that missing access checks in the Struts ActionForm object could result in the execution of arbitrary code. This update fixes this problem.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of IBM WebSphere Portal installed on the remote host is 7.0.0.x prior to 7.0.0.2 CF29. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     Apache Struts ClassLoader. A remote attacker can exploit     this issue by manipulating the 'class' parameter of an     ActionForm object to execute arbitrary code.
    (CVE-2014-0114)

  - A cross-site scripting vulnerability exists which allows     a remote, authenticated attacker to inject arbitrary     web script or HTML. (CVE-2014-0910)

  - An unspecified denial of service vulnerability exists     that allows a remote attacker to crash the host by     sending a specially crafted web request to cause a     consumption of resources. (CVE-2014-0949)

  - A cross-site scripting vulnerability exists in the     'boot_config.jsp' script due to improper validation of     user-supplied input. An attacker can exploit this issue     to execute arbitrary script code in the security context     of a user's browser to steal authentication cookies.
    (CVE-2014-0952)

  - An unspecified cross-site scripting vulnerability exists     due to improper validation of user-supplied input.
    (CVE-2014-0953)

  - A privilege escalation vulnerability exists in the Web     Content Viewer portlet due to improper handling of JSP     includes. A remote attacker can exploit this issue to     obtain sensitive information, cause a denial of service,     or control the request dispatcher by sending a specially     crafted URL request. (CVE-2014-0954)

  - An unspecified cross-site scripting vulnerability exists     due to improper validation of user-supplied input. An     attacker can exploit this issue to execute arbitrary     script code in the security context of a user's web     browser to steal authentication cookies. (CVE-2014-0956)

  - An unspecified denial of service vulnerability exists     that allows an authenticated attacker to cause a     successful login to loop back to the login page     indefinitely. (CVE-2014-0959)

  - An unspecified information disclosure vulnerability     exists which allows a remote attacker to gain access to     sensitive information. (CVE-2014-3083)

  - An unspecified cross-site scripting vulnerability     exists due to improper validation of user-supplied     input. An attacker can exploit this issue to execute     arbitrary script code in the security context of a     user's browser. (CVE-2014-3102)

  - An information disclosure vulnerability exists due to     the returned error codes which an attacker can use to     identify devices behind a firewall. (CVE-2014-4746)

  - An unspecified open redirect vulnerability exists that     allows an attacker to perform a phishing attack by     enticing a user to click on a malicious URL.
    (CVE-2014-4760)

  - An information disclosure vulnerability exists which     allows a remote, authenticated attacker to gain access     to sensitive information, such as user credentials,     through certain HTML pages. (CVE-2014-4761)

  - An unrestricted file upload vulnerability exists which     allows a remote, authenticated attacker to upload large     files, potentially resulting in a denial of service.
    (CVE-2014-4792)

  - An unspecified vulnerability exists that allows an     authenticated attacker to execute arbitrary code on the     system. (CVE-2014-4808)

  - A flaw exists due to improper recursion detection during     entity expansion. A remote attacker, via a specially     crafted XML document, can cause the system to crash,     resulting in a denial of service. (CVE-2014-4814)

  - An information disclosure vulnerability exists that     allows a remote attacker to identify whether or not a     file exists based on the web server error codes.
    (CVE-2014-4821)

  - An unspecified cross-site scripting vulnerability exists     that allows a remote, authenticated attacker to execute     arbitrary code via a specially crafted URL.
    (CVE-2014-6093)

  - An unspecified reflected cross-site scripting     vulnerability exists due to improper validation of     user-supplied input. A remote attacker can exploit this     flaw using a specially crafted URL to execute arbitrary     script code in a user's web browser within the security     context of the hosting website. This allows an attacker     to steal a user's cookie-based authentication     credentials. (CVE-2014-6215)

  - An unspecified reflected cross-site scripting     vulnerability exists due to improper validation of     user-supplied input. A remote attacker can exploit this     flaw using a specially crafted URL to execute arbitrary     script code in a user's web browser within the security     context of the hosting website. This allows an attacker     to steal a user's cookie-based authentication     credentials. (CVE-2014-8909)

  - An unspecified flaw exists that is trigged when handling     Portal requests. A remote attacker can exploit this to     cause a consumption of CPU resources, resulting in a     denial of service condition. (CVE-2015-1943)

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     Apache Struts ClassLoader. A remote attacker can exploit     this issue by manipulating the 'class' parameter of an     ActionForm object to execute arbitrary code.
    (CVE-2014-0114)

  - An unspecified information disclosure vulnerability     exists which allows a remote attacker to gain access to     sensitive information. (CVE-2014-3083)

  - An information disclosure vulnerability exists which     allows a remote, authenticated attacker to gain access     to sensitive information, such as user credentials,     through certain HTML pages. (CVE-2014-4761)

  - An unspecified cross-site scripting vulnerability exists     due to improper validation of user input. This can be     exploited by a remote, authenticated attacker to execute     code in the security context of a user's browser.
    (CVE-2014-4762)

  - An unrestricted file upload vulnerability exists which     allows a remote, authenticated attacker to upload large     files, potentially resulting in a denial of service.
    (CVE-2014-4792)

  - An unspecified cross-site scripting vulnerability exists     that allows remote, authenticated attackers to execute     arbitrary code via a specially crafted URL.
    (CVE-2014-6093)

Updated struts packages that fix one security issue are now available for Red Hat Network Satellite 5.4 and 5.5, and Red Hat Satellite 5.6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool.

Apache Struts is a framework for building web applications with Java.

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method.
A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. (CVE-2014-0114)

All Satellite users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For this update to take effect, the tomcat6 service must be restarted ('service tomcat6 restart').

The version of Oracle Enterprise Data Quality running on the remote host is affected by multiple vulnerabilities :

  - A flaw in Apache Commons BeanUtils allows a remote     attacker to execute arbitrary code by manipulating the     ClassLoader. (CVE-2014-0114)

  - A flaw in Apache Tomcat allows a remote attacker to     replace the XML parsers and thereby gain access to     sensitive information. (CVE-2014-0119)

The remote Oracle Adaptive Access Manager installation is missing a vendor supplied update that fixes a flaw in Apache Struts which allows remote attackers to execute arbitrary code.

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities :

  - The application is affected by a vulnerability in     Apache Commons BeanUtils in which ClassLoader objects     can be set via the class attribute of an ActionForm     object. This can be used to manipulate the ClassLoader     or execute arbitrary code. (CVE-2014-0114)

  - The application is subject to a cross-site redirection     attack because user-supplied input to the 'backUrl'     parameter is not properly validated. (CVE-2014-2880)

  - An unspecified vulnerability exists in the End User     Self Service component. (CVE-2014-6487).

The remote host has a version of Oracle WebLogic Server installed that is affected by multiple unspecified vulnerabilities affecting the following components :

  - WebLogic Tuxedo Connector
  - WLS-Console (Struts based)
  - WLS-Console

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2.
It is, therefore, affected by multiple vulnerabilities in third party libraries :

  - The bundled version of Apache Struts contains a code     execution flaw. Note that 5.0 Update 3c only addresses     this vulnerability. (CVE-2014-0114)

  - The bundled tc-server / Apache Tomcat contains multiple     vulnerabilities. (CVE-2013-4590, CVE-2013-4322, and     CVE-2014-0050)

  - The bundled version of Oracle JRE is prior to 1.7.0_55     and thus is affected by multiple vulnerabilities. Note     that this only affects version 5.5 of vCenter.

a. vCenter Server Apache Struts Update

   The Apache Struts library is updated to address a security issue.  

   This issue may lead to remote code execution after authentication.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifier CVE-2014-0114 to this issue.


b. vCenter Server tc-server 2.9.5 / Apache Tomcat 7.0.52 updates

   tc-server has been updated to version 2.9.5 to address multiple    security issues. This version of tc-server includes Apache Tomcat    7.0.52.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2013-4590, CVE-2013-4322, and    CVE-2014-0050 to these issues. 

c. Update to ESXi glibc package

   glibc is updated to address multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2013-0242 and CVE-2013-1914 to    these issues. 

d. vCenter and Update Manager, Oracle JRE 1.7 Update 55

   Oracle has documented the CVE identifiers that are addressed in    JRE 1.7.0 update 55 in the Oracle Java SE Critical Patch Update    Advisory of April 2014. The References section provides a link to    this advisory.

The version of IBM WebSphere Portal on the remote host is affected by a remote code execution vulnerability in the Apache Struts ClassLoader. A remote attacker can exploit this issue by manipulating the 'class' parameter of an ActionForm object to execute arbitrary code.

fix CVE-2014-0114

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that missing access checks in the Struts ActionForm object could result in the execution of arbitrary code.

IBM WebSphere Application Server 7.0 prior to Fix Pack 33 is running on the remote host. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting flaw exists within the     Administration Console, where user input is improperly     validated. This could allow a remote attacker, with a     specially crafted request, to execute arbitrary script     code within the browser / server trust relationship.
    (CVE-2013-6323, PI04777 and PI04880)

  - A denial of service flaw exists within the Global     Security Kit when handling SSLv2 resumption during the     SSL/TLS handshake. This could allow a remote attacker     to crash the program. (CVE-2013-6329, PI05309)

  - A buffer overflow flaw exists in the HTTP server with     the mod_dav module when using add-ons. This could allow     a remote attacker to cause a buffer overflow and a     denial of service. (CVE-2013-6438, PI09345)

  - A cross-site scripting flaw exists within OAuth where     user input is not properly validated. This could allow     a remote attacker, with a specially crafted request, to     execute arbitrary script code within the browser /     server trust relationship. (CVE-2013-6738, PI05661)

  - A denial of service flaw exists within the Global     Security Kit when handling X.509 certificate chain     during the initiation of an SSL/TLS connection. A remote     attacker, using a malformed certificate chain, could     cause the client or server to crash by hanging the     Global Security Kit. (CVE-2013-6747, PI09443)

  - A denial of service flaw exists within the Apache     Commons FileUpload when parsing a content-type header     for a multipart request. A remote attacker, using a     specially crafted request, could crash the program.
    (CVE-2014-0050, PI12648, PI12926 and PI13162)

  - A denial of service flaw exists in the 'mod_log_config'     when logging a cookie with an unassigned value. A remote     attacker, using a specially crafted request, can cause     the program to crash. (CVE-2014-0098, PI13028)

  - A remote code execution flaw exists with Apache Struts.
    The failure to restrict setting of Class loader     attributes could allow a remote attacker to     execute arbitrary script code. (CVE-2014-0114, PI17190)

  - An information disclosure flaw exists in the     'sun.security.rsa.RSAPadding' with 'PKCS#1' unpadding.
    This many allow a remote attacker to gain timing     information intended to be protected by encryption.
    (CVE-2014-0453)

  - A flaw exists within 'com.sun.jndi.dns.DnsClient'     related to the randomization of query IDs. This could     allow a remote attacker to conduct spoofing attacks.
    (CVE-2014-0460)

  - A denial of service flaw exists in a web server plugin     on servers configured to retry failed POST request. This     could allow a remote attacker to crash the application.
    (CVE-2014-0859, PI08892)

  - A flaw exists with the 'IBMJCE' and 'IBMSecureRandom'     cryptographic providers by generating numbers in a     predictable manner. This could allow a remote attacker     to easily guess the output of the random number     generator. (CVE-2014-0878)

  - An information disclosure flaw exists within Proxy and     ODR servers. This could allow a remote attacker, using a     specially crafted request, to gain access to potentially     sensitive information. (CVE-2014-0891, PI09786)

  - A denial of service flaw exists within the IBM Security     Access Manager for Web with the Reverse Proxy component.
    This could allow a remote attacker, using specially     crafted TLS traffic, to cause the application on the     system to become unresponsive. (CVE-2014-0963, PI17025)

  - An information disclosure flaw exists when handling SOAP     responses. This could allow a remote attacker to     potentially gain access to sensitive information.
    (CVE-2014-0965, PI11434)

  - An information disclosure flaw exists. A remote     attacker, using a specially crafted URL, could gain     access to potentially sensitive information.
    (CVE-2014-3022, PI09594)

Updated struts packages fix security vulnerability :

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method.
A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions (CVE-2014-0114).

From Red Hat Security Advisory 2014:0474 :

Updated struts packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Apache Struts is a framework for building web applications with Java.

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method.
A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. (CVE-2014-0114)

All struts users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using struts must be restarted for this update to take effect.

Updated struts packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Apache Struts is a framework for building web applications with Java.

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method.
A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. (CVE-2014-0114)

All struts users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using struts must be restarted for this update to take effect.

The remote web application appears to use Struts, a web application framework. The version of Struts in use contains a flaw that allows the manipulation of the ClassLoader via the 'class' parameter of an ActionForm object that results a denial of service.

Note that this vulnerability may be exploited to execute arbitrary remote code in certain application servers with specific configurations; however, Nessus has not tested for this issue.

Additionally, note that this plugin will only report the first vulnerable instance of a Struts application.

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method.
A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. (CVE-2014-0114)

All running applications using struts must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
212392	Oracle Siebel Server 8.5.1.x <= 8.5.1.7 / 8.6.0 / 8.6.1 (April 2019 CPU)	Nessus	Misc.	critical
183108	Ubuntu 16.04 ESM / 18.04 ESM : Apache Commons BeanUtils vulnerabilities (USN-4766-1)	Nessus	Ubuntu Local Security Checks	high
141566	IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.14 / 9.0.x <= 9.0.0.9 Multiple Vulnerabilities (711865)	Nessus	Web Servers	high
112192	Apache ActiveMQ 5.x < 5.15.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical
9699	IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
92479	GLSA-201607-09 : Commons-BeanUtils: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
82203	Debian DLA-57-1 : libstruts1.2-java security update	Nessus	Debian Local Security Checks	high
79691	IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF29 Multiple Vulnerabilities	Nessus	CGI abuses	high
79216	IBM WebSphere Portal 8.5.0 < 8.5.0 CF02 Multiple Vulnerabilities	Nessus	CGI abuses	high
79018	RHEL 6 : struts (RHSA-2014:0500)	Nessus	Red Hat Local Security Checks	high
78749	Oracle Enterprise Data Quality Multiple Vulnerabilities (October 2014 CPU)	Nessus	CGI abuses	high
78700	Oracle Adaptive Access Manager Server Arbitrary Code Execution (October 2014 CPU)	Nessus	Misc.	high
78542	Oracle Identity Manager (October 2014 CPU	Nessus	Misc.	high
78541	Oracle WebLogic Server Multiple Vulnerabilities (October 2014 CPU)	Nessus	Misc.	high
77728	VMware Security Updates for vCenter Server (VMSA-2014-0008)	Nessus	Misc.	critical
77630	VMSA-2014-0008 : VMware vSphere product updates to third-party libraries	Nessus	VMware ESX Local Security Checks	high
77535	IBM WebSphere Portal Apache Struts ClassLoader Manipulation RCE	Nessus	CGI abuses	high
77351	Fedora 20 : struts-1.3.10-10.fc20 (2014-9380)	Nessus	Fedora Local Security Checks	high
77306	Debian DSA-2940-1 : libstruts1.2-java - security update	Nessus	Debian Local Security Checks	high
76967	IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities	Nessus	Web Servers	high
74073	Mandriva Linux Security Advisory : struts (MDVSA-2014:095)	Nessus	Mandriva Local Security Checks	high
73935	Oracle Linux 5 : struts (ELSA-2014-0474)	Nessus	Oracle Linux Local Security Checks	high
73922	CentOS 5 : struts (CESA-2014:0474)	Nessus	CentOS Local Security Checks	high
73919	Apache Struts ClassLoader Manipulation	Nessus	Denial of Service	high
73907	Scientific Linux Security Update : struts on SL5.x i386/x86_64 (20140507)	Nessus	Scientific Linux Local Security Checks	high
73901	RHEL 5 : struts (RHSA-2014:0474)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2014-0114

medium

Tenable Plugins

critical

high

high

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high