Apache · Struts
CVE-2016-3081
Apache Struts Command Injection Vulnerability
O que é
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CISA: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
O que fazer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Prazo para as agências federais dos EUA: 11 de outubro de 2026
- Adicionada à lista da CISA
- 8 de outubro de 2026
- Publicada
- 26 de abril de 2016
- Gravidade
- Alto 8,1 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 97% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-77
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (11)
- http://www.securitytracker.com/id/1035665
- https://struts.apache.org/docs/s2-032.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- https://www.exploit-db.com/exploits/39756/
- http://www.securityfocus.com/bid/91787
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execut…
- http://www.securityfocus.com/bid/87327
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
Mais falhas exploradas de Apache
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 25 de mar. de 2022 | Improper Input Validation | Struts | Crítica 9,8 | >99,9% |
| 3 de nov. de 2021 | Remote Code Execution | Struts | Crítica 9,8 | >99,9% |
| 3 de nov. de 2021 | Deserialization of Untrusted Data | Struts | Alto 8,1 | 99,4% |
| 3 de nov. de 2021 | Remote Code Execution | Struts | Alto 8,1 | >99,9% |
| 3 de nov. de 2021 | Remote Code Execution | Struts | Crítica 9,8 | 96% |
| 4 de ago. de 2026 | Missing Encryption of Sensitive Data | Tomcat | Alto 7,5 | 99% |
| 16 de abr. de 2026 | Improper Input Validation | ActiveMQ | Alto 8,8 | 98% |
| 1 de mai. de 2025 | Improper Escaping of Output | HTTP Server | Crítica 9,1 | >99,9% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.