CVE-2016-3081
HIGH NUCLEIApache Struts < 2.3.20.3 - Command Injection
Title source: ruleDescription
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/39756
metasploit
WORKING POC
EXCELLENT
by Nixawk, rungobier · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_exec.rb
Nuclei Templates (1)
Apache S2-032 Struts - Remote Code Execution
HIGHby dhiyaneshDK
Shodan:
http.html:"apache struts" || http.title:"struts2 showcase" || http.html:"struts problem report"
FOFA:
body="struts problem report" || title="struts2 showcase" || body="apache struts"
References (11)
Scores
CVSS v3
8.1
EPSS
0.9397
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
Status
published
Products (50)
apache/struts
2.0.0
apache/struts
2.0.1
apache/struts
2.0.2
apache/struts
2.0.3
apache/struts
2.0.4
apache/struts
2.0.5
apache/struts
2.0.6
apache/struts
2.0.7
apache/struts
2.0.8
apache/struts
2.0.9
... and 40 more
Published
Apr 26, 2016
Tracked Since
Feb 18, 2026