Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

CRITICAL 9.8CVE-2016-3087 · GHSA-mmj6-cjj4-hpr5 · Published 07/06/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.struts:struts2-core Maven	`≥ 2.3.19, < 2.3.20.3≥ 2.3.21, < 2.3.24.3≥ 2.3.25, < 2.3.28.1`	`2.3.20.32.3.24.32.3.28.1`
struts apache	`= 2.3.20= 2.3.20.1= 2.3.24= 2.3.24.1= 2.3.28`	No fix yet

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-3087 · ADVISORY
apache/struts commit 6bd694b · WEB
apache/struts · PACKAGE
web.archive.org/web/20160616082237/http://www.securitytracker.com/id/1036017 · WEB
web.archive.org/web/20160728170709/http://www.securityfocus.com/bid/90960 · WEB
exploit-db.com/exploits/39919 · WEB
struts.apache.org/docs/s2-033.html · WEB
www-01.ibm.com/support/docview.wss · WEB
securityfocus.com/bid/90960
securitytracker.com/id/1036017
exploit-db.com/exploits/39919

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free