ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Struts | Apache | 2.0.0 (including) | 2.3.16.2 (excluding) |