CVE-2016-3081
Apache Struts Command Injection Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-10-08. Federal due date: 2026-10-11.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)2016-05-02 · remote · linux · Verified
Impact
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >= 2.3.19, <= 2.3.20.2 | 2.3.20.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Huawei | Agile Controller-Campus Firmware | Version v100r002c00 |
| Huawei | Anyoffice | Versions v200r005c00, v200r006c00 |
| Huawei | Logcenter | Versions v100r001c10, v100r001c20 |
| Huawei | Firehunter6000 Firmware | Version v100r001c20 |
| Huawei | Oceanstor 5300 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 5500 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 5600 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 5800 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 6800 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 18500 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 18500f Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
| Huawei | Oceanstor 18800 V3 Firmware | Versions v300r001, v300r002, v300r003c00, v300r003c10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
- http://www.securityfocus.com/bid/87327
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1035665
- https://struts.apache.org/docs/s2-032.html
- https://www.exploit-db.com/exploits/39756/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081
- https://github.com/advisories/GHSA-8c6j-ffmf-q6vm
- https://nvd.nist.gov/vuln/detail/CVE-2016-3081
- https://web.archive.org/web/20210123152457/http://www.securityfocus.com/bid/91787
- https://web.archive.org/web/20210225192113/http://www.securityfocus.com/bid/87327
- https://web.archive.org/web/20210226011418/http://www.securitytracker.com/id/1035665