Read the docs
TI-2014-00108 Aliases CVE-2014-0114GHSA-p66x-2cv9-qq3v

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache…

Priority CRITICAL 86CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 10 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.99032 99th percentileScored 2026-11-07
Fix Partial commons-beanutils:commons-beanutils (Maven): 1.9.4Red Hat: 7 advisoriesRed Hat: 10 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—commons-beanutils:commons-beanutils (Maven)1.8.0 to before 1.9.41.9.4Patch availableGHSA-p66x-2cv9-qq3v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • commons-beanutils:commons-beanutils (Maven) Vendor— Affected 1.8.0 to before 1.9.4 Fixed in 1.9.4 Patch available GHSA-p66x-2cv9-qq3v

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:*up to 1.9.1VulnerableApache
cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*1.0VulnerableApache
cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableApache
cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*1.1 b1VulnerableApache
cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*1.1 b2VulnerableApache
cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*1.1 b3VulnerableApache
cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*1.1 rc1VulnerableApache
cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*1.1 rc2VulnerableApache
cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableApache
  • cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:* Versions up to 1.9.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:* Versions 1.1 b1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:* Versions 1.1 b2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:* Versions 1.1 b3 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:* Versions 1.1 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Apache
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableApache
cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableApache
cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableApache
cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableApache
cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableApache
cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableApache
cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*1.3.8VulnerableApache
cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*1.3.10VulnerableApache
  • cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:* Versions 1.2.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:* Versions 1.3.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:* Versions 1.3.10 Vulnerable ·Apache

Remediation

  • Fix · GHSA-p66x-2cv9-qq3v commons-beanutils:commons-beanutils (Maven) Fixed in 1.9.4 Advisory →

Red Hat 7 advisories

  • RHSA-2019:2995 Released 2019-10-10 · Red Hat rating Important
    Red Hat A-MQ Broker 7.5 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7
  • RHSA-2014:0511 Released 2014-05-15 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.2.1 security update
    • Red Hat JBoss Operations Network 3.2
Show 4 more Red Hat advisories
  • RHSA-2014:0500 Released 2014-05-14 · Red Hat rating Important
    struts security update
    • Red Hat Satellite 5.4 (RHEL v.6) struts-1.3.10-6.ep5.el6, struts-core-1.3.10-6.ep5.el6, struts-extras-1.3.10-6.ep5.el6 +2
    • Red Hat Satellite 5.5 (RHEL v.6) struts-1.3.10-6.ep5.el6, struts-core-1.3.10-6.ep5.el6, struts-extras-1.3.10-6.ep5.el6 +2
    • Red Hat Satellite 5.6 (RHEL v.6) struts-1.3.10-6.ep5.el6, struts-core-1.3.10-6.ep5.el6, struts-extras-1.3.10-6.ep5.el6 +2
  • RHSA-2014:0497 Released 2014-05-14 · Red Hat rating Important
    Red Hat JBoss Fuse 6.1.0 security update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0498 Released 2014-05-14 · Red Hat rating Important
    Fuse ESB Enterprise 7.1.0 security update
    • Fuse ESB Enterprise 7.1.0
  • RHSA-2014:0474 Released 2014-05-07 · Red Hat rating Important
    struts security update
    • Red Hat Enterprise Linux (v. 5 server) struts-1.2.9-4jpp.8.el5_10, struts-1.2.9-4jpp.8.el5_10.i386, struts-1.2.9-4jpp.8.el5_10.ia64 +13
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) struts-1.2.9-4jpp.8.el5_10, struts-1.2.9-4jpp.8.el5_10.i386, struts-javadoc-1.2.9-4jpp.8.el5_10 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix yet
Fuse ESB Enterprise 7.1.0Fixed RHSA-2014:0498
Red Hat AMQ Broker 7Fixed RHSA-2019:2995
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2014:0474
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2014:0474
Red Hat Fuse 7Fixed RHSA-2018:2669
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0497
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:0511
Red Hat Satellite 5.4 (RHEL v.6)Fixed RHSA-2014:0500
Red Hat Satellite 5.5 (RHEL v.6)Fixed RHSA-2014:0500
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2014:0500

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0114
  2. 2026-10-03 Alias added: GHSA-p66x-2cv9-qq3v
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: HIGH → CRITICAL
  5. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Advisory 10

Other 146

  • TI-2025-30956 Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default CVSS 3.1HIGH 8.8
  • TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences