{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37643?format=json","vulnerability_id":"VCID-84ge-vq7u-j3ar","summary":"Incomplete fix for ClassLoader manipulation via ParametersInterceptor\nThe `ParametersInterceptor` in this package allows remote attackers to `manipulate` the `ClassLoader` via the class parameter, which is passed to the getClass method.","aliases":[{"alias":"CVE-2014-0094"},{"alias":"GHSA-vrwc-qjmw-5rjm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51771?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.16.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ghqg-ae1b-w7br"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.2"},{"url":"http://public2.vulnerablecode.io/api/packages/63326?format=json","purl":"pkg:maven/org.apache.struts.xwork/xwork-core@2.3.16.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts.xwork/xwork-core@2.3.16.2"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51175?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2-alpha0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1exe-1vfk-f7bn"},{"vulnerability":"VCID-1kjb-use6-23eu"},{"vulnerability":"VCID-4x3k-a11x-7bee"},{"vulnerability":"VCID-84ge-vq7u-j3ar"},{"vulnerability":"VCID-89az-256b-mubw"},{"vulnerability":"VCID-e78f-s5z5-qkgs"},{"vulnerability":"VCID-emya-8et9-n7a9"},{"vulnerability":"VCID-kc4z-fnyk-tkdu"},{"vulnerability":"VCID-kcy9-3d45-23b1"},{"vulnerability":"VCID-kmqa-hsqy-muf1"},{"vulnerability":"VCID-wsvw-qwt7-qbg1"},{"vulnerability":"VCID-xd9a-gdh3-97ar"},{"vulnerability":"VCID-z6wr-3psx-dbfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2-alpha0"},{"url":"http://public2.vulnerablecode.io/api/packages/51770?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.16.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1uv2-rvmy-53hk"},{"vulnerability":"VCID-84ge-vq7u-j3ar"},{"vulnerability":"VCID-8jup-umjw-9ba4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.1"},{"url":"http://public2.vulnerablecode.io/api/packages/62399?format=json","purl":"pkg:maven/org.apache.struts.xwork/xwork-core@2.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1kjb-use6-23eu"},{"vulnerability":"VCID-4x3k-a11x-7bee"},{"vulnerability":"VCID-84ge-vq7u-j3ar"},{"vulnerability":"VCID-89az-256b-mubw"},{"vulnerability":"VCID-wsvw-qwt7-qbg1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts.xwork/xwork-core@2.0.0"}],"references":[{"reference_url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045","reference_id":"","reference_type":"","scores":[],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045"},{"reference_url":"http://jvn.jp/en/jp/JVN19294237/index.html","reference_id":"","reference_type":"","scores":[],"url":"http://jvn.jp/en/jp/JVN19294237/index.html"},{"reference_url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html","reference_id":"","reference_type":"","scores":[],"url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"},{"reference_url":"https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f"},{"reference_url":"https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62"},{"reference_url":"http://struts.apache.org/docs/s2-021.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-021.html"},{"reference_url":"http://struts.apache.org/release/2.3.x/docs/s2-020.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/release/2.3.x/docs/s2-020.html"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113"},{"reference_url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676706","reference_id":"","reference_type":"","scores":[],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676706"},{"reference_url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm","reference_id":"","reference_type":"","scores":[],"url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"},{"reference_url":"http://www.konakart.com/downloads/ver-7-3-0-0-whats-new","reference_id":"","reference_type":"","scores":[],"url":"http://www.konakart.com/downloads/ver-7-3-0-0-whats-new"},{"reference_url":"http://www.vmware.com/security/advisories/VMSA-2014-0007.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.vmware.com/security/advisories/VMSA-2014-0007.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0094","reference_id":"CVE-2014-0094","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0094"},{"reference_url":"https://github.com/advisories/GHSA-vrwc-qjmw-5rjm","reference_id":"GHSA-vrwc-qjmw-5rjm","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vrwc-qjmw-5rjm"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-84ge-vq7u-j3ar"}