Apache · Struts
CVE-2016-3081
Apache Struts Command Injection Vulnerability
Cos'è
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CISA: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Cosa fare
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Scadenza per le agenzie federali USA: 11 ottobre 2026
- Aggiunta all'elenco CISA
- 8 ottobre 2026
- Pubblicato
- 26 aprile 2016
- Gravità
- Alta 8,1 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 97% tra il 0,1% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-77
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (11)
- http://www.securitytracker.com/id/1035665
- https://struts.apache.org/docs/s2-032.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- https://www.exploit-db.com/exploits/39756/
- http://www.securityfocus.com/bid/91787
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execut…
- http://www.securityfocus.com/bid/87327
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
Altre falle sfruttate di Apache
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 25 mar 2022 | Improper Input Validation | Struts | Critica 9,8 | >99,9% |
| 3 nov 2021 | Remote Code Execution | Struts | Critica 9,8 | >99,9% |
| 3 nov 2021 | Deserialization of Untrusted Data | Struts | Alta 8,1 | 99,4% |
| 3 nov 2021 | Remote Code Execution | Struts | Alta 8,1 | >99,9% |
| 3 nov 2021 | Remote Code Execution | Struts | Critica 9,8 | 96% |
| 4 ago 2026 | Missing Encryption of Sensitive Data | Tomcat | Alta 7,5 | 99% |
| 16 apr 2026 | Improper Input Validation | ActiveMQ | Alta 8,8 | 98% |
| 1 mag 2025 | Improper Escaping of Output | HTTP Server | Critica 9,1 | >99,9% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.