CVE-2016-3087
CRITICALApache Struts < 2.3.20.3 - Improper Input Validation
Title source: ruleDescription
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Exploits (3)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/39919
metasploit
WORKING POC
EXCELLENT
by Nixawk · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.rb
References (5)
Scores
CVSS v3
9.8
EPSS
0.8701
EPSS Percentile
99.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (6)
apache/struts
2.3.20
apache/struts
2.3.20.1
apache/struts
2.3.24
apache/struts
2.3.24.1
apache/struts
2.3.28
org.apache.struts/struts2-core
2.3.19 - 2.3.20.3Maven
Published
Jun 07, 2016
Tracked Since
Feb 18, 2026