vulnwire
9.8crit

CVE-2016-3087in critical feed2 exploits

Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

Also known as GHSA-mmj6-cjj4-hpr5

Published 10 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
81.9%
percentile 100%
Public exploits
2
Exploit-DB

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

Exploit prediction (EPSS)

81.87% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-43382 Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution · remote · 2017-06-06
  • EDB-39919 Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit) · remote · 2016-06-10

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.struts:struts2-core
>=2.3.19, <2.3.20.3
>=2.3.21, <2.3.24.3
>=2.3.25, <2.3.28.1
2.3.20.3
2.3.24.3
2.3.28.1

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.