GHSA-mmj6-cjj4-hpr5
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
At a glance
- Published
- Updated
- CVE
- CVE-2016-3087
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an `!` (exclamation mark) operator to the REST Plugin.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.struts:struts2-core | introduced 2.3.19, fixed 2.3.20.3 |
| Maven · org.apache.struts:struts2-core | introduced 2.3.21, fixed 2.3.24.3 |
| Maven · org.apache.struts:struts2-core | introduced 2.3.25, fixed 2.3.28.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3087 ADVISORY
- https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f WEB
- https://github.com/apache/struts PACKAGE
- https://web.archive.org/web/20160616082237/http://www.securitytracker.com/id/1036017 WEB
- https://web.archive.org/web/20160728170709/http://www.securityfocus.com/bid/90960 WEB
- https://www.exploit-db.com/exploits/39919 WEB
- http://struts.apache.org/docs/s2-033.html WEB
- http://www-01.ibm.com/support/docview.wss?uid=swg21987854 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |