CVE-2016-3087

Critical

Published: 07/06/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

Risk Assessment

Exploitation of this vulnerability could lead to full control over the application, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update Apache Struts to the latest version to mitigate this vulnerability and disable Dynamic Method Invocation if it is not necessary.

Original NVD description (English source)

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.