RCE in Apache Struts
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.942 (99.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Struts — versions 2.0.0, 2.0.1, 2.0.2
- Oracle Siebel_e-billing — versions 7.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 1035665 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
- 39756 (exploit, x_refsource_EXPLOIT-DB)
- 91787 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_BID)
- secalert@redhat.com (Exploit, Third Party Advisory, x_refsource_MISC)
- 87327 (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2016-3081?
- CVE-2016-3081 is a high-severity vulnerability in Apache Struts, classified under Command Injection. CVSS score: 8.1/10. Published 2016-04-26.
- How severe is CVE-2016-3081?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2016-3081 known to be exploited?
- 31 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.