ClassLoader manipulation in Apache Struts
Date: 2022-05
Affected: maven/org.apache.struts:struts2-core
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2014-0116

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.


Mitigations:

Architectural layers (MAESTRO):