CVE-2016-3087
Critical · 9.8CVSS
9.8
EPSS
81.9%
Published
Jun 7, 2016
CISA due date
—
The record
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.3.19 | 2.3.20.3 |
| Maven | org.apache.struts:struts2-core | 2.3.21 | 2.3.24.3 |
| Maven | org.apache.struts:struts2-core | 2.3.25 | 2.3.28.1 |
| maven | org.apache.struts/struts2-core | 2.3.19 | 2.3.20.3 |
| maven | org.apache.struts/struts2-core | 2.3.21 | 2.3.24.3 |
| maven | org.apache.struts/struts2-core | 2.3.25 | 2.3.28.1 |
Related vulnerabilities
- GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation Also affects org.apache.struts:struts2-core
- CVE-2025-68493 Missing XML Validation vulnerability in Apache Struts, Apache Struts. Also affects org.apache.struts:struts2-core
- GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- CVE-2025-66675 Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2025-64775 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2024-53677 Apache Struts file upload logic is flawed Also affects org.apache.struts:struts2-core
- CVE-2012-1592 A local code execution issue exists in Apache Struts2 when processing malformed XSLT… Also affects org.apache.struts:struts2-core