Gravité: : Élevé
  Identifiant(s) CVE: : CVE-2014-0114
  Date du conseil: 21 juillet 2015

  Description

The Apache Struts used by the IBM WebSphere Application Server could allow a remote attacker to execute arbitrary code on the system. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and execute arbitrary code on the system.

  Information Exposure Rating:

Apply associated Trend Micro DPI Rules.

  Solutions

  Trend Micro Deep Security DPI Rule Number: 1006015
  Trend Micro Deep Security DPI Rule Name: 1006015 - Restrict Apache Struts 'class.classLoader' Request

  Affected software and version:

  • apache struts 1.0
  • apache struts 1.0.2
  • apache struts 1.1
  • apache struts 1.2.2
  • apache struts 1.2.4
  • apache struts 1.2.6
  • apache struts 1.2.7
  • apache struts 1.2.8
  • apache struts 1.2.9
  • apache struts 1.3.10
  • apache struts 1.3.5
  • apache struts 1.3.8