CVE-2014-0114
HighExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to the latest version of Apache Commons BeanUtils and review application code to eliminate the possibility of ClassLoader manipulation.
Other vulnerabilities in Apache Commons BeanUtils
See all- CVE-2019-10086High
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. However, this was not used by default by PropertyUtilsBean.
- CVE-2025-48734High
Improper Access Control vulnerability in Apache Commons BeanUtils. If an application passes property paths from an external source directly to PropertyUtilsBean.getProperty() or getNestedProperty(), an attacker can access the 'declaredClass' property of enum objects, gaining access to the ClassLoader and executing arbitrary code.
Original NVD description (English source)
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS