High 7.5Published Apr 30, 2014

CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the…

Updated under an hour ago (2026-10-19 08:20 UTC)

Does this affect you?

It affects apache commons_beanutils and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for apache commons_beanutils

Exploited in the last 30 days

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

CVSS: 7.5 HIGH (v2.0, NVD)AV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: redhat
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

apache commons_beanutils apache:commons_beanutils	through 1.9.1	NVD
apache struts apache:struts	1.0; 1.0.2; 1.1; 1.1; 1.1; 1.1; 1.1; 1.1; and 9 more ranges	NVD

References

http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.htmlmailing-list, x-refsource-mlist
http://secunia.com/advisories/57477third-party-advisory, x-refsource-secunia
http://www.vmware.com/security/advisories/VMSA-2014-0008.htmlx-refsource-confirm
https://issues.apache.org/jira/browse/BEANUTILS-463x-refsource-confirm
http://secunia.com/advisories/58710third-party-advisory, x-refsource-secunia
http://www.mandriva.com/security/advisories?name=MDVSA-2014:095vendor-advisory, x-refsource-mandriva
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlx-refsource-confirm
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlx-refsource-confirm
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlx-refsource-confirm
http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlx-refsource-confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21675689x-refsource-confirm
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.htmlvendor-advisory, x-refsource-fedora
http://www-01.ibm.com/support/docview.wss?uid=swg21674812x-refsource-confirm
https://security.netapp.com/advisory/ntap-20140911-0001/x-refsource-confirm
http://secunia.com/advisories/59464third-party-advisory, x-refsource-secunia
http://secunia.com/advisories/59118third-party-advisory, x-refsource-secunia
https://security.netapp.com/advisory/ntap-20180629-0006/x-refsource-confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21675387x-refsource-confirm
https://access.redhat.com/solutions/869353x-refsource-confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1091938x-refsource-confirm
http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txtx-refsource-confirm
http://advisories.mageia.org/MGASA-2014-0219.htmlx-refsource-confirm
http://secunia.com/advisories/60703third-party-advisory, x-refsource-secunia
http://www-01.ibm.com/support/docview.wss?uid=swg21675972x-refsource-confirm
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755x-refsource-confirm
http://marc.info/?l=bugtraq&m=140119284401582&w=2
http://marc.info/?l=bugtraq&m=140801096002766&w=2
http://marc.info/?l=bugtraq&m=141451023707502&w=2
http://openwall.com/lists/oss-security/2014/06/15/10
http://openwall.com/lists/oss-security/2014/07/08/1
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/58851
http://secunia.com/advisories/58947
http://secunia.com/advisories/59014
http://secunia.com/advisories/59228
http://secunia.com/advisories/59245
http://secunia.com/advisories/59246
http://secunia.com/advisories/59430
http://secunia.com/advisories/59479
http://secunia.com/advisories/59480

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.