CVE-2016-3081KEV · OVERDUECWE-77command-injection

Apache Struts Command Injection Vulnerability

High · published April 26, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

11
days past CISA
deadline
CVSS v3.1
8.1
EPSS
96%
Percentile
99.9
In the wild
Confirmed
What it is

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.96052 · 99.9th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2016-04-26T18:59Z
KEV added
2026-10-08 · due 2026-10-11
Affected products (66)
ProductVersionsFixed in
huawei/agile_controller-campus_firmwareall versions—
huawei/anyofficeall versions—
huawei/anyofficeall versions—
huawei/logcenterall versions—
huawei/logcenterall versions—
huawei/firehunter6000_firmwareall versions—
huawei/oceanstor_5300_v3_firmwareall versions—
huawei/oceanstor_5300_v3_firmwareall versions—
huawei/oceanstor_5300_v3_firmwareall versions—
huawei/oceanstor_5300_v3_firmwareall versions—
huawei/oceanstor_5500_v3_firmwareall versions—
huawei/oceanstor_5500_v3_firmwareall versions—
huawei/oceanstor_5500_v3_firmwareall versions—
huawei/oceanstor_5500_v3_firmwareall versions—
huawei/oceanstor_5600_v3_firmwareall versions—
huawei/oceanstor_5600_v3_firmwareall versions—
huawei/oceanstor_5600_v3_firmwareall versions—
huawei/oceanstor_5600_v3_firmwareall versions—
huawei/oceanstor_5800_v3_firmwareall versions—
huawei/oceanstor_5800_v3_firmwareall versions—
huawei/oceanstor_5800_v3_firmwareall versions—
huawei/oceanstor_5800_v3_firmwareall versions—
huawei/oceanstor_6800_v3_firmwareall versions—
huawei/oceanstor_6800_v3_firmwareall versions—
huawei/oceanstor_6800_v3_firmwareall versions—
huawei/oceanstor_6800_v3_firmwareall versions—
huawei/oceanstor_18500_v3_firmwareall versions—
huawei/oceanstor_18500_v3_firmwareall versions—
huawei/oceanstor_18500_v3_firmwareall versions—
huawei/oceanstor_18500_v3_firmwareall versions—
huawei/oceanstor_18500f_firmwareall versions—
huawei/oceanstor_18500f_firmwareall versions—
huawei/oceanstor_18500f_firmwareall versions—
huawei/oceanstor_18500f_firmwareall versions—
huawei/oceanstor_18800_v3_firmwareall versions—
huawei/oceanstor_18800_v3_firmwareall versions—
huawei/oceanstor_18800_v3_firmwareall versions—
huawei/oceanstor_18800_v3_firmwareall versions—
huawei/oceanstor_18800f_firmwareall versions—
huawei/oceanstor_18800f_firmwareall versions—
huawei/oceanstor_18800f_firmwareall versions—
huawei/oceanstor_18800f_firmwareall versions—
huawei/oceanstor_9000_firmwareall versions—
huawei/oceanstor_9000_firmwareall versions—
huawei/oceanstor_9000_firmwareall versions—
huawei/oceanstor_n8500_firmwareall versions—
huawei/oceanstor_n8500_firmwareall versions—
huawei/oceanstor_n8500_firmwareall versions—
huawei/oceanstor_n8500_firmwareall versions—
huawei/oceanstor_onebox_firmwareall versions—
apache/struts≥ 2.3.20, < 2.3.20.32.3.20.3
apache/struts≥ 2.3.21, < 2.3.24.32.3.24.3
apache/struts≥ 2.3.25, < 2.3.28.12.3.28.1
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/micros_retail_xbri_loss_preventionall versions—
oracle/siebel_e-billingall versions—
References (23)
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html · [email protected]http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · [email protected]http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · [email protected]http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec · [email protected]http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec · [email protected]http://www.securityfocus.com/bid/87327 · [email protected]http://www.securityfocus.com/bid/91787 · [email protected]http://www.securitytracker.com/id/1035665 · [email protected]https://struts.apache.org/docs/s2-032.html · [email protected]https://www.exploit-db.com/exploits/39756/ · [email protected]http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · af854a3a-2127-422b-91ae-364da2661108http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec · af854a3a-2127-422b-91ae-364da2661108http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/87327 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/91787 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1035665 · af854a3a-2127-422b-91ae-364da2661108https://struts.apache.org/docs/s2-032.html · af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/39756/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 11
    kev
  • 22 SEP 03:12Z
    EPSS moved 93% → 83%
    epss
  • 06 SEP 03:09Z
    EPSS moved 93% → 83%
    epss
  • 30 AUG 15:31Z
    EPSS moved 83% → 93%
    epss
  • 29 AUG 04:11Z
    EPSS moved 93% → 83%
    epss
  • 26 APR 14:00Z
    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
    cvelistv5