GitHub Advisoryadvisory · Maven

GHSA-mmj6-cjj4-hpr5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

CRITICAL Published 2022-05-14 Modified 2023-12-29 Official page ↗
Aliases
CVE-2016-3087
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-12-29

Affected packages

• Maven org.apache.struts:struts2-core: >= 2.3.19, < 2.3.20.3 → fixed in 2.3.20.3 • Maven org.apache.struts:struts2-core: >= 2.3.21, < 2.3.24.3 → fixed in 2.3.24.3 • Maven org.apache.struts:struts2-core: >= 2.3.25, < 2.3.28.1 → fixed in 2.3.28.1

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an `!` (exclamation mark) operator to the REST Plugin.

Related

Alias · CVE (1)

  • CVE-2016-3087 Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References