Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2016-3087

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

VectorNETWORK

PublishedJun 07, 2016, 18:59

Published Bysecalert@redhat.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.struts:struts2-core(Maven)2.3.192.3.20.3N/A

org.apache.struts:struts2-core(Maven)2.3.212.3.24.3N/A

org.apache.struts:struts2-core(Maven)2.3.252.3.28.1N/A

References

http://struts.apache.org/docs/s2-033.html
http://www-01.ibm.com/support/docview.wss?uid=swg21987854
http://www.securityfocus.com/bid/90960
http://www.securitytracker.com/id/1036017
https://www.exploit-db.com/exploits/39919/

Weakness Type

CWE-20

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK