Apache Struts RCE Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-3081US | high8.1OT critical | KEV | ||
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method:… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.htmlWEB
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-enWEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlWEB
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlWEB
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_execWEB
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_execWEB
- https://github.com/apache/strutsPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-3081ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan