CVE-2016-3081

HIGH

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

CVSS v3.1 Score

8.1
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 4/26/2016Modified: 10/9/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (23)

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.htmlExploitThird Party Advisoryhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-enThird Party Advisoryhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchThird Party Advisoryhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlThird Party Advisoryhttp://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_execThird Party AdvisoryBroken Linkhttp://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_execThird Party Advisoryhttp://www.securityfocus.com/bid/87327Third Party AdvisoryVDB Entryhttp://www.securityfocus.com/bid/91787Third Party AdvisoryVDB Entryhttp://www.securitytracker.com/id/1035665Third Party AdvisoryVDB Entryhttps://struts.apache.org/docs/s2-032.htmlPatchVendor Advisoryhttps://www.exploit-db.com/exploits/39756/ExploitThird Party Advisoryhttp://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.htmlExploitThird Party Advisoryhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-enThird Party Advisoryhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchThird Party Advisoryhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlThird Party Advisoryhttp://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_execThird Party AdvisoryBroken Linkhttp://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_execThird Party Advisoryhttp://www.securityfocus.com/bid/87327Third Party AdvisoryVDB Entryhttp://www.securityfocus.com/bid/91787Third Party AdvisoryVDB Entryhttp://www.securitytracker.com/id/1035665Third Party AdvisoryVDB Entryhttps://struts.apache.org/docs/s2-032.htmlPatchVendor Advisoryhttps://www.exploit-db.com/exploits/39756/ExploitThird Party Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081US Government Resource