CVE-2016-3081
critical-risk
Published 2016-04-26
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Do I need to act?
!
94.0% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10
High
NETWORK
/ HIGH complexity
Affected Products (20)
References (22)
Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
Third Party Advisory
http://www.securityfocus.com/bid/91787
Third Party Advisory
http://www.securitytracker.com/id/1035665
Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
Third Party Advisory
http://www.securityfocus.com/bid/91787
Third Party Advisory
http://www.securitytracker.com/id/1035665
and 2 more references
77
/ 100
critical-risk
Severity
24/34 · High
Exploitability
27/34 · High
Exposure
26/34 · High