Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an `!` (exclamation mark) operator to the REST Plugin.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-3087US | critical9.8 | Exploit | ||
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors… | ||||
02
references
External citations — patches, advisories, analysis.
- http://struts.apache.org/docs/s2-033.htmlWEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21987854WEB
- https://github.com/apache/strutsPACKAGE
- https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2fWEB
- https://nvd.nist.gov/vuln/detail/CVE-2016-3087ADVISORY
- https://web.archive.org/web/20160616082237/http://www.securitytracker.com/id/1036017WEB
- https://web.archive.org/web/20160728170709/http://www.securityfocus.com/bid/90960WEB
- https://www.exploit-db.com/exploits/39919WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan