WaratekVRT Sign in

CVE-2014-0114

Affected software2 products, listed below
Severity7.5 High CVSS 2.0
Fixed in1.9.4
WeaknessImproper input validation (CWE-20)
Published30 Apr 2014
Updated14 Oct 2026

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2022-05-11.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 5 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2014-03-06.
  • EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2014-0114 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation blog.checkpoint.com /security/april-2022s-most-wanted-malware-a-shake-up-in-the-index-but-emotet-is-still-on-top 2022-05-11

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC A request parameter filter solution for Struts 1 CVE-2014-0114 based on the work of Alvaro Munoz and the HP Fortify team 12 2014-05-22
GitHub PoC aenlr/strutt-cve-2014-0114 2 2019-05-27
GitHub PoC struts1 CVE-2014-0114 classLoader manipulation vulnerability patch 1 2014-06-10
Exploit-DB Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit) 2014-03-06
Metasploit Apache Struts ClassLoader Manipulation Remote Code Execution (manual rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2014-0114.armr patch rule, ARMR 2.6 added 2018-10-12 updated 2026-03-04
Sign in to download

How to mitigate CVE-2014-0114

Upgrade the affected software to 1.9.4 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Financial Services Applications / UI (Beanutils) (8.0.6, 8.0.7)
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Siebel CRM / Information Manager Console (Apache Commons BeanUtils) (High)
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Communications Applications / Media (BeanUtils) (7.0, 7.1, 7.2)
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle Utilities Applications / System Wide (4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0, 4.3.0.3.0)
Oracle Critical Patch Update January 2015 ↗ CPU 2015-Q1 Oracle Fusion Middleware / Oracle Real-Time Decision Server (11.1.1.7, RTD Platform 3.0.x)
Oracle Fusion Middleware / Oracle Waveset (8.1.1)
Oracle Fusion Middleware / Oracle WebLogic Portal (10.0.1.0, 10.2.1.0, 10.3.6.0)
Oracle Critical Patch Update October 2014 ↗ CPU 2014-Q4 Oracle Communications Applications / Infrastructure, LSR, ASR (Struts based) (MetaSolv Solution: 6.2.1.0.0, LSR: 9.4.0, 10.1.0, ASR: 49.0.0)
Oracle Fusion Middleware / ADF Controllers (Struts based) (10.1.3.5, 11.1.1.7, 11.1.2.4, 12.1.2.0, 12.1.3.0)
Oracle's note: Please refer to Doc ID My Oracle Support Note 1926728.1 for instructions on how to address this issue. This fix also addresses CVE-2014-0050.
Oracle Fusion Middleware / Launchpad (Struts based) (8.1.2, 9.0.11)
Oracle Fusion Middleware / OAAM Server (Struts based) (11.1.1.5, 11.1.1.7, 11.1.2.1, 11.1.2.2)
Oracle Fusion Middleware / OIM Legacy UI (Struts based) (11.1.1.5, 11.1.1.7, 11.1.2.1, 11.1.2.2)
Oracle Fusion Middleware / WLS-Console (Struts based) (10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0, 12.1.3.0)
Oracle Primavera Products Suite / Web Access (Struts based) (13.1, 14.0)
Oracle Primavera Products Suite / Web Access (Struts based) (7.0, 8.0, 8.1, 8.2, 8.3)
Oracle Retail Applications / General application (Struts based) (10.0, 11.0, 12.0, 13.0, 13.1, 13.2)
Oracle Retail Applications / General application (Struts based) (11.0, 12.0, 12.0 IN, 12.1, 13.0, 13.1, 13.2, 14.0)
Oracle Retail Applications / General application (Struts based) (12.0, 13.0, 13.1, 13.2, 13.4)
Oracle Retail Applications / General application (Struts based) (13.3, 13.4, 14.0)
Oracle Critical Patch Update July 2014 ↗ CPU 2014-Q3 Oracle Retail Applications / Security (2.0, 13.1, 13.2, 13.3, 13.4, 14.0)
Oracle Retail Applications / Security (8.0, 12.0, 12.0.9IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0)
Oracle Retail Applications / Security (8.0, 12.0, 12.0.9IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Infrastructure, LSR, ASR (Struts based) MetaSolv Solution: 6.2.1.0.0, LSR: 9.4.0, 10.1.0, ASR: 49.0.0 6.2.1.0.0 · 9.4.0 · 10.1.0 · 49.0.0
Oracle Communications Applications Media (BeanUtils) 7.0, 7.1, 7.2 7.0 · 7.1 · 7.2
Oracle Financial Services Applications UI (Beanutils) 8.0.6, 8.0.7 8.0.6 · 8.0.7
Oracle Fusion Middleware ADF Controllers (Struts based) 10.1.3.5, 11.1.1.7, 11.1.2.4, 12.1.2.0, 12.1.3.0 10.1.3.5 · 11.1.1.7 · 11.1.2.4 · 12.1.2.0 · 12.1.3.0
Oracle Fusion Middleware Launchpad (Struts based) 8.1.2, 9.0.11 8.1.2 · 9.0.11
Oracle Fusion Middleware OAAM Server (Struts based) 11.1.1.5, 11.1.1.7, 11.1.2.1, 11.1.2.2 11.1.1.5 · 11.1.1.7 · 11.1.2.1 · 11.1.2.2
Oracle Fusion Middleware OIM Legacy UI (Struts based) 11.1.1.5, 11.1.1.7, 11.1.2.1, 11.1.2.2 11.1.1.5 · 11.1.1.7 · 11.1.2.1 · 11.1.2.2
Oracle Fusion Middleware Oracle Real-Time Decision Server 11.1.1.7, RTD Platform 3.0.x 3.0 · 11.1.1.7
Oracle Fusion Middleware Oracle Waveset 8.1.1 8.1.1
Oracle Fusion Middleware Oracle WebLogic Portal 10.0.1.0, 10.2.1.0, 10.3.6.0 10.0.1.0 · 10.2.1.0 · 10.3.6.0
Oracle Fusion Middleware WLS-Console (Struts based) 10.0.2.0, 10.3.6.0, 12.1.1.0, 12.1.2.0, 12.1.3.0 10.0.2.0 · 10.3.6.0 · 12.1.1.0 · 12.1.2.0 · 12.1.3.0
Oracle Primavera Products Suite Web Access (Struts based) 7.0, 8.0, 8.1, 8.2, 8.3 7.0 · 8.0 · 8.1 · 8.2 · 8.3 · 13.1 · 14.0
Oracle Retail Applications General application (Struts based) 10.0, 11.0, 12.0, 13.0, 13.1, 13.2 10.0 · 11.0 · 12.0 · 12.1 · 13.0 · 13.1 · 13.2 · 13.3 · 13.4 · 14.0
Oracle Retail Applications Security 2.0, 13.1, 13.2, 13.3, 13.4, 14.0 2.0 · 8.0 · 12.0 · 12.0.9 · 13.0 · 13.1 · 13.2 · 13.3 · 13.4 · 14.0
Oracle Siebel CRM Information Manager Console (Apache Commons BeanUtils) High
Oracle Utilities Applications System Wide 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0, 4.3.0.3.0 4.1.0.1.0 · 4.1.0.2.0 · 4.2.0.1.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.3.0.1.0 · 4.3.0.2.0 · 4.3.0.3.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-beanutils:commons-beanutils 1.8.0 1.9.4 unbounded

Products and versions

3 products, 19 version entries
SourceVendorProductSchemeAffected versions
nvd apache commons beanutils generic ≤ 1.9.1
nvd apache struts generic 1.0 · 1.0.2 · 1.1 · 1.1:rc1 · 1.1:rc2 · 1.1:b1 · 1.1:b2 · 1.1:b3 · 1.2.2 · 1.2.4 · 1.2.6 · 1.2.7 · 1.2.8 · 1.2.9 · 1.3.5 · 1.3.8 · 1.3.10
osv commons-beanutils commons-beanutils generic ≥ 1.8.0 and ＜ 1.9.4

References

URLTags
https://github.com/apache/commons-beanutils/pull/7 WEB
https://github.com/apache/commons-beanutils/commit/62e82ad92cf4818709d6044aaf257b73d42659a4 WEB
https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6@%3Cissues.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E WEB
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E WEB
https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639%40%3Ccommits.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639@%3Ccommits.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E WEB
https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E WEB

Timeline
Published2014-04-30By the CVE Program.
ARMR remediation created2018-10-12Earliest commit adding this CVE's ARMR patch or security rule.
VulnCheck KEV: earliest evidence2022-05-11Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-10-14NVD's own last-modified date for this record.