Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to …
High CVSS 8.1 Listed in CISA KEV
Summary
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- Apache:Struts
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
- CISA KEV DATABASE
Original Links
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Vendor Advisory
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
- http://www.securityfocus.com/bid/87327
- http://www.securityfocus.com/bid/91787 Third Party Advisory
- http://www.securitytracker.com/id/1035665 Third Party Advisory
- https://struts.apache.org/docs/s2-032.html Patch
- https://www.exploit-db.com/exploits/39756/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081
- https://cwiki.apache.org/confluence/display/WW/S2-032 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2016-3081 reference
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV