CVEvulnerability
CVE-2016-3081
CISA Known Exploited Vulnerability
Apache Struts Command Injection Vulnerability — Apache Struts
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
- Added to KEV
- 2026-10-08
- Remediation due
- 2026-10-11
- Ransomware use
- Unknown
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Notes
- This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081
- Status
- Analyzed
- Published
- 2016-04-26
- Last modified
- 2026-10-09
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-77
Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Affected configurations
• huawei agile controller-campus firmware v100r002c00
• huawei anyoffice v200r005c00
• huawei anyoffice v200r006c00
• huawei logcenter v100r001c10
• huawei logcenter v100r001c20
• huawei firehunter6000 firmware v100r001c20
• huawei oceanstor 5300 v3 firmware v300r001
• huawei oceanstor 5300 v3 firmware v300r002
• huawei oceanstor 5300 v3 firmware v300r003c00
• huawei oceanstor 5300 v3 firmware v300r003c10
• huawei oceanstor 5500 v3 firmware v300r001
• huawei oceanstor 5500 v3 firmware v300r002
• huawei oceanstor 5500 v3 firmware v300r003c00
• huawei oceanstor 5500 v3 firmware v300r003c10
• huawei oceanstor 5600 v3 firmware v300r001
• huawei oceanstor 5600 v3 firmware v300r002
• huawei oceanstor 5600 v3 firmware v300r003c00
• huawei oceanstor 5600 v3 firmware v300r003c10
• huawei oceanstor 5800 v3 firmware v300r001
• huawei oceanstor 5800 v3 firmware v300r002
• huawei oceanstor 5800 v3 firmware v300r003c00
• huawei oceanstor 5800 v3 firmware v300r003c10
• huawei oceanstor 6800 v3 firmware v300r001
• huawei oceanstor 6800 v3 firmware v300r002
• huawei oceanstor 6800 v3 firmware v300r003c00
• huawei oceanstor 6800 v3 firmware v300r003c10
• huawei oceanstor 18500 v3 firmware v300r001
• huawei oceanstor 18500 v3 firmware v300r002
• huawei oceanstor 18500 v3 firmware v300r003c00
• huawei oceanstor 18500 v3 firmware v300r003c10
• huawei oceanstor 18500f firmware v300r001
• huawei oceanstor 18500f firmware v300r002
• huawei oceanstor 18500f firmware v300r003c00
• huawei oceanstor 18500f firmware v300r003c10
• huawei oceanstor 18800 v3 firmware v300r001
• huawei oceanstor 18800 v3 firmware v300r002
• huawei oceanstor 18800 v3 firmware v300r003c00
• huawei oceanstor 18800 v3 firmware v300r003c10
• huawei oceanstor 18800f firmware v300r001
• huawei oceanstor 18800f firmware v300r002
• huawei oceanstor 18800f firmware v300r003c00
• huawei oceanstor 18800f firmware v300r003c10
• huawei oceanstor 9000 firmware v100r001c01
• huawei oceanstor 9000 firmware v100r001c30
• huawei oceanstor 9000 firmware v300r005c00
• huawei oceanstor n8500 firmware v200r001c09spc505
• huawei oceanstor n8500 firmware v200r001c91spc205
• huawei oceanstor n8500 firmware v200r001c91spc900
• huawei oceanstor n8500 firmware v200r001c91spc901
• huawei oceanstor onebox firmware v100r003c10
• apache struts (>= 2.3.20 < 2.3.20.3)
• apache struts (>= 2.3.21 < 2.3.24.3)
• apache struts (>= 2.3.25 < 2.3.28.1)
• oracle flexcube private banking 2.0.0.0
• oracle flexcube private banking 2.0.1
• oracle flexcube private banking 2.2.0
• oracle flexcube private banking 12.0.1
• oracle flexcube private banking 12.0.3
• oracle flexcube private banking 12.1.0
• oracle micros retail xbri loss prevention 10.0.1
… and 6 more
Related
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
- http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
- https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
- http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
- https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 US Government Resource