critical9.8Public exploit code
CVE-2016-3087
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit)2016-06-10 · remote · multiple · Verified
- Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution2017-06-06 · remote · multiple
Impact
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | Versions 2.3.20, 2.3.20.1, 2.3.24, 2.3.24.1, 2.3.28 |
Weakness classification
References
- NVD record
- CVE.org record
- http://struts.apache.org/docs/s2-033.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21987854
- http://www.securityfocus.com/bid/90960
- http://www.securitytracker.com/id/1036017
- https://www.exploit-db.com/exploits/39919/
- http://struts.apache.org/docs/s2-033.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21987854
- http://www.securityfocus.com/bid/90960
- http://www.securitytracker.com/id/1036017
- https://www.exploit-db.com/exploits/39919/