Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products…

Description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Scores

EPSS (exploitation in 30 days)

99.0% · top 0.1% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavencommons-beanutils:commons-beanutilsGHSA-p66x-2cv9-qq3v (opens in a new tab)

References (119)

• [apache-ignite-developers] 20180601 [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 57477 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.vmware.com/security/advisories/VMSA-2014-0008.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://issues.apache.org/jira/browse/BEANUTILS-463 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 58710 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDVSA-2014:095 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21675689 (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2014-9380 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21674812 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://security.netapp.com/advisory/ntap-20140911-0001/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• 59464 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59118 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://security.netapp.com/advisory/ntap-20180629-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21675387 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://access.redhat.com/solutions/869353 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=1091938 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://advisories.mageia.org/MGASA-2014-0219.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 60703 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21675972 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21676375 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2018:2669 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• GLSA-201607-09 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• HPSBST03160 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21675898 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21676110 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg27042296 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21676303 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 59228 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59246 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=1116665 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 59245 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBMU03090 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21674128 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21676931 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 60177 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.ibm.com/support/docview.wss?uid=swg21675496 (opens in a new tab)x_refsource_CONFIRMx_transferred
• DSA-2940 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21675266 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 59014 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21677110 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21676091 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 67121 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 59480 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• HPSBGN03041 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 59479 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59704 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 58947 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59718 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 59430 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 58851 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html (opens in a new tab)x_refsource_MISCx_transferred
• [commons-issues] 20190521 [jira] [Created] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190522 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-issues] 20190522 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-dev] 20190522 [beanutils2] CVE-2014-0114 Pull Request (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-dev] 20190525 Re: [beanutils2] CVE-2014-0114 Pull Request (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-commits] 20190528 [commons-beanutils] branch master updated: BEANUTILS-520: Mitigate CVE-2014-0114 by enabling SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS by default. (#7) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190528 [jira] [Closed] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #74 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-commits] 20190528 [commons-beanutils] branch master updated: [BEANUTILS-520] BeanUtils2 mitigate CVE-2014-0114. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190528 [jira] [Work logged] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-notifications] 20190528 Build failed in Jenkins: commons-beanutils #75 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-dev] 20190605 Re: [beanutils] Towards 1.10 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-issues] 20190615 [jira] [Updated] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190615 [jira] [Reopened] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190615 [jira] [Resolved] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [commons-dev] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-user] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [announce] 20190814 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190818 [jira] [Commented] (BEANUTILS-520) BeanUtils2 mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-gitbox] 20190903 [GitHub] [activemq-artemis] jeloba opened a new pull request #2820: Updated Apache BeanUtils to address CVE (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-issues] 20190904 [jira] [Created] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-commits] 20190906 [commons-configuration] branch master updated: [CONFIGURATION-755][CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-issues] 20190909 [jira] [Work logged] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• RHSA-2019:2995 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [commons-issues] 20191014 [jira] [Updated] (BEANUTILS-520) Mitigate CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [activemq-issues] 20200109 [jira] [Resolved] (ARTEMIS-2470) Update Apache BeanUtils to Address CVE-2014-0114 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [lucene-solr-user] 20200320 Re: CVEs (vulnerabilities) that apply to Solr 8.4.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [dolphinscheduler-commits] 20210121 [GitHub] [incubator-dolphinscheduler] c-f-cooper commented on issue #4506: There is a vulnerability in beanutils 1.7.0,upgrade recommended (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-p66x-2cv9-qq3v (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2014-0114](https://trackcve.app/badge/CVE-2014-0114.svg)](https://trackcve.app/cve/CVE-2014-0114)

Record last updated 14 Oct 2026, 16:20 UTC.