1. Home
  2. Vulnerabilities
  3. CVE-2016-3081
Known Exploited Vulnerability
9.3
HIGH CVSS 2.0
CVE-2016-3081
Apache Struts Command Injection Vulnerability - [Actively Exploited]
Overview
Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Details
INFO

Published Date :

April 26, 2016, 2:59 p.m.

Last Modified :

Oct. 9, 2026, 2:43 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

Required Action :

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Known Ransomware Campaign Use:

Unknown

Notes :

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081

Impact
Affected Products

The following products are affected by CVE-2016-3081 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Huawei oceanstor_5800_v3_firmware
2 Huawei logcenter
3 Huawei anyoffice
4 Huawei oceanstor_5600_v3_firmware
5 Huawei oceanstor_18800f_firmware
6 Huawei oceanstor_9000_firmware
7 Huawei agile_controller-campus_firmware
8 Huawei agile_controller-campus
9 Huawei oceanstor_18800f
10 Huawei oceanstor_9000
11 Huawei oceanstor_5800_v3
12 Huawei oceanstor_5600_v3
13 Huawei firehunter6000_firmware
14 Huawei firehunter6000
15 Huawei oceanstor_5300_v3_firmware
16 Huawei oceanstor_5300_v3
17 Huawei oceanstor_5500_v3_firmware
18 Huawei oceanstor_5500_v3
19 Huawei oceanstor_6800_v3_firmware
20 Huawei oceanstor_6800_v3
21 Huawei oceanstor_18500_v3_firmware
22 Huawei oceanstor_18500_v3
23 Huawei oceanstor_18500f_firmware
24 Huawei oceanstor_18500f
25 Huawei oceanstor_18800_v3_firmware
26 Huawei oceanstor_18800_v3
27 Huawei oceanstor_n8500_firmware
28 Huawei oceanstor_n8500
29 Huawei oceanstor_onebox_firmware
30 Huawei oceanstor_onebox
1 Oracle flexcube_private_banking
2 Oracle siebel_e-billing
3 Oracle micros_retail_xbri_loss_prevention
1 Apache struts
: Total Affected Vendor : 3 | Products : 34
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 2.0 HIGH [email protected]
CVSS 3.0 HIGH [email protected]
CVSS 3.1 HIGH 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1 HIGH [email protected]
Solution
A remote code execution vulnerability exists in Apache Struts, which can be addressed by upgrading to a patched version or applying appropriate workarounds.
  • Upgrade to Apache Struts version 2.3.28.1 or later.
  • Alternatively, apply vendor-provided workarounds.
Public PoC/Exploit Available at Github

CVE-2016-3081 has a 23 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2016-3081.

URL Resource
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory VDB Entry
https://struts.apache.org/docs/s2-032.html Patch Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory VDB Entry
https://struts.apache.org/docs/s2-032.html Patch Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2016-3081 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2016-3081 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Elymaro/Struty

Detect and automate multiple Struts framework vulnerabilities

audit java javaee pentest security struts struts2 tool

Python

Updated: 1 year, 2 months ago
0 stars 0 fork 0 watcher
Born at : April 25, 2025, 12:10 p.m. This repo has been linked 16 different CVEs too.
Profile Photo
XiaomingX/awesome-poc-for-red-team

A curated collection of Proof of Concept (PoC) tools, scripts, and techniques designed for red team operations, penetration testing, and cybersecurity research. This repository focuses on providing practical resources for exploring vulnerabilities

attack cybersecurity exp hw penetration-testing poc red-team security-tools vulnerability-poc

Updated: 1 year, 9 months ago
5 stars 3 fork 3 watcher
Born at : Nov. 17, 2024, 11:53 a.m. This repo has been linked 414 different CVEs too.
Profile Photo
bakery312/Vulhub-Reproduce

None

Updated: 1 year, 5 months ago
5 stars 1 fork 1 watcher
Born at : Jan. 26, 2024, 10:07 a.m. This repo has been linked 161 different CVEs too.
Profile Photo
NyxAzrael/Goby_POC

在公网收集的gobypoc+部分自己加的poc

Updated: 1 year, 3 months ago
111 stars 8 fork 8 watcher
Born at : July 28, 2023, 4:28 p.m. This repo has been linked 296 different CVEs too.
Profile Photo
superlink996/chunqiuyunjingbachang

春秋云境靶场解题攻略

Updated: 1 year, 6 months ago
7 stars 0 fork 0 watcher
Born at : July 28, 2023, 8:14 a.m. This repo has been linked 125 different CVEs too.
Profile Photo
ice0bear14h/struts2scan

Struts2 full range of vulnerability scanning

Python

Updated: 3 years, 9 months ago
0 stars 1 fork 1 watcher
Born at : Jan. 8, 2023, 8:24 a.m. This repo has been linked 19 different CVEs too.
Profile Photo
20142995/pocsuite3

pocsuite3 POC 588个

Python

Updated: 1 year, 9 months ago
111 stars 23 fork 23 watcher
Born at : Nov. 26, 2022, 5:52 a.m. This repo has been linked 108 different CVEs too.
Profile Photo
20142995/Goby

None

Python Go

Updated: 1 year, 9 months ago
576 stars 138 fork 138 watcher
Born at : Nov. 25, 2022, 5:20 a.m. This repo has been linked 174 different CVEs too.
Profile Photo
Threekiii/Vulhub-Reproduce

一个Vulhub漏洞复现知识库

vulnerability exploit

Updated: 2 years, 1 month ago
448 stars 87 fork 87 watcher
Born at : March 3, 2022, 8:38 a.m. This repo has been linked 171 different CVEs too.
Profile Photo
Threekiii/Awesome-POC

一个漏洞 PoC 知识库。A knowledge base for vulnerability PoCs(Proof of Concept), with 1k+ vulnerabilities.

poc

Dockerfile Java Python

Updated: 5 months, 2 weeks ago
4956 stars 974 fork 974 watcher
Born at : Feb. 20, 2022, 6:43 a.m. This repo has been linked 497 different CVEs too.
Profile Photo
SexyBeast233/SecBooks

安全类各家文库大乱斗

HTML CSS JavaScript Go Python Shell C

Updated: 1 year, 2 months ago
1195 stars 286 fork 286 watcher
Born at : Feb. 15, 2022, 3:14 a.m. This repo has been linked 568 different CVEs too.
Profile Photo
Zero094/Vulnerability-verification

None

Updated: 1 year, 6 months ago
21 stars 3 fork 3 watcher
Born at : Jan. 6, 2022, 8:19 a.m. This repo has been linked 55 different CVEs too.
Profile Photo
ronoski/j2ee-rscan

None

HTML Java

Updated: 5 years, 4 months ago
0 stars 0 fork 0 watcher
Born at : May 27, 2021, 11:56 a.m. This repo has been linked 22 different CVEs too.
Profile Photo
Elsfa7-110/kenzer-templates

None

Python XSLT

Updated: 1 year, 6 months ago
20 stars 5 fork 5 watcher
Born at : May 22, 2021, 4:29 p.m. This repo has been linked 350 different CVEs too.
Profile Photo
ARPSyndicate/kenzer-templates

essential templates for kenzer [DEPRECATED]

kenzer vulnerabilities kenzer-templates arpsyndicate

Python Shell Ruby

Updated: 1 year, 3 months ago
117 stars 38 fork 38 watcher
Born at : Sept. 18, 2020, 9:03 p.m. This repo has been linked 1655 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2016-3081 vulnerability anywhere in the article.

  • The Hacker News
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked thr ... Read more

Published Date: Oct 09, 2026 (2 weeks, 3 days ago)
  • The Hacker News
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agenc ... Read more

Published Date: Oct 08, 2026 (2 weeks, 4 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2016-3081 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Oct. 09, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Removed CVSS V3 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:agile_controller-campus:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:huawei:logcenter:v100r001c10:*:*:*:*:*:*:* *cpe:2.3:a:huawei:anyoffice:v200r006c00:*:*:*:*:*:*:* *cpe:2.3:a:huawei:anyoffice:v200r005c00:*:*:*:*:*:*:* *cpe:2.3:a:huawei:logcenter:v100r001c20:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:firehunter6000_firmware:v100r001c20:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:firehunter6000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_5300_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_5500_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_5600_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_5800_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_6800_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_18500_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_18500f:v3:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_18800_v3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r001:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r002:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c00:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_18800f:v3:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c01:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c30:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r005c00:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_9000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c09spc505:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc205:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc900:*:*:*:*:*:*:* *cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc901:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_n8500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:oceanstor_onebox_firmware:v100r003c10:*:*:*:*:*:*:* OR cpe:2.3:h:huawei:oceanstor_onebox:-:*:*:*:*:*:*:*
    Changed CPE Configuration OR *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* OR *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.3.20 up to (excluding) 2.3.20.3 *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.3.21 up to (excluding) 2.3.24.3 *cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* versions from (including) 2.3.25 up to (excluding) 2.3.28.1
    Changed CPE Configuration OR *cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:* OR *cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:flexcube_private_banking:2.2.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:*
    Added Reference Type Red Hat, Inc.: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Types: Third Party Advisory
    Changed Reference Type Red Hat, Inc.: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Vendor Advisory Red Hat, Inc.: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Third Party Advisory
    Changed Reference Type Red Hat, Inc.: http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Third Party Advisory Red Hat, Inc.: http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Broken Link, Third Party Advisory
    Added Reference Type Red Hat, Inc.: http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Types: Third Party Advisory
    Added Reference Type Red Hat, Inc.: http://www.securityfocus.com/bid/87327 Types: Third Party Advisory, VDB Entry
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 Types: US Government Resource
    Added Reference Type Red Hat, Inc.: https://www.exploit-db.com/exploits/39756/ Types: Exploit, Third Party Advisory, VDB Entry
    Added Reference Type CVE: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Types: Third Party Advisory
    Changed Reference Type CVE: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Vendor Advisory CVE: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Third Party Advisory
    Changed Reference Type CVE: http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Third Party Advisory CVE: http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Broken Link, Third Party Advisory
    Added Reference Type CVE: http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Types: Third Party Advisory
    Added Reference Type CVE: http://www.securityfocus.com/bid/87327 Types: Third Party Advisory, VDB Entry
    Added Reference Type CVE: https://www.exploit-db.com/exploits/39756/ Types: Exploit, Third Party Advisory, VDB Entry
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 09, 2026

    Action Type Old Value New Value
    Removed SSVC {'id': 'CVE-2016-3081', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-08T17:40:07.972437Z'}
    Added SSVC {'id': 'CVE-2016-3081', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-08T00:00:00+00:00'}
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Oct. 08, 2026

    Action Type Old Value New Value
    Added Date Added 2026-10-08
    Added Due Date 2026-10-08
    Added Required Action 2026-10-08
    Added Vulnerability Name 2026-10-08
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 08, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-77
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081
    Added SSVC {'id': 'CVE-2016-3081', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-08T17:40:07.972437Z'}
  • CVE Modified by [email protected]

    Oct. 08, 2026

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
    Added Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    Added Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Added Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
    Added Reference http://www.securityfocus.com/bid/87327
    Added Reference http://www.securityfocus.com/bid/91787
    Added Reference http://www.securitytracker.com/id/1035665
    Added Reference https://struts.apache.org/docs/s2-032.html
    Added Reference https://www.exploit-db.com/exploits/39756/
    Removed Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
    Removed Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
    Removed Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
    Removed Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    Removed Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Removed Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
    Removed Reference http://www.securityfocus.com/bid/87327
    Removed Reference http://www.securityfocus.com/bid/91787
    Removed Reference http://www.securitytracker.com/id/1035665
    Removed Reference https://struts.apache.org/docs/s2-032.html
    Removed Reference https://www.exploit-db.com/exploits/39756/
    Removed Reference Type http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Types: Exploit, Third Party Advisory
    Removed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Types: Patch, Third Party Advisory
    Removed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Vendor Advisory
    Removed Reference Type http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Third Party Advisory
    Removed Reference Type http://www.securityfocus.com/bid/91787 Types: Third Party Advisory, VDB Entry
    Removed Reference Type http://www.securitytracker.com/id/1035665 Types: Third Party Advisory, VDB Entry
    Removed Reference Type https://struts.apache.org/docs/s2-032.html Types: Patch, Vendor Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Oct. 08, 2026

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
    Added Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    Added Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Added Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
    Added Reference http://www.securityfocus.com/bid/87327
    Added Reference http://www.securityfocus.com/bid/91787
    Added Reference http://www.securitytracker.com/id/1035665
    Added Reference https://struts.apache.org/docs/s2-032.html
    Added Reference https://www.exploit-db.com/exploits/39756/
    Removed Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
    Removed Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
    Removed Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
    Removed Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    Removed Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Removed Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
    Removed Reference http://www.securityfocus.com/bid/87327
    Removed Reference http://www.securityfocus.com/bid/91787
    Removed Reference http://www.securitytracker.com/id/1035665
    Removed Reference https://struts.apache.org/docs/s2-032.html
    Removed Reference https://www.exploit-db.com/exploits/39756/
    Removed Reference Type http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Types: Exploit, Third Party Advisory
    Removed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Types: Patch, Third Party Advisory
    Removed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Types: Vendor Advisory
    Removed Reference Type http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Types: Third Party Advisory
    Removed Reference Type http://www.securityfocus.com/bid/91787 Types: Third Party Advisory, VDB Entry
    Removed Reference Type http://www.securitytracker.com/id/1035665 Types: Third Party Advisory, VDB Entry
    Removed Reference Type https://struts.apache.org/docs/s2-032.html Types: Patch, Vendor Advisory
  • CVE Modified by [email protected]

    Jun. 17, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}]
  • Status Change by [email protected]

    May. 06, 2026

    Action Type Old Value New Value
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
    Added Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    Added Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Added Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
    Added Reference http://www.securityfocus.com/bid/87327
    Added Reference http://www.securityfocus.com/bid/91787
    Added Reference http://www.securitytracker.com/id/1035665
    Added Reference https://struts.apache.org/docs/s2-032.html
    Added Reference https://www.exploit-db.com/exploits/39756/
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Aug. 12, 2019

    Action Type Old Value New Value
    Changed Description Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
  • CVE Modified by [email protected]

    Dec. 01, 2016

    Action Type Old Value New Value
    Added Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en [No Types Assigned]
    Added Reference https://www.exploit-db.com/exploits/39756/ [No Types Assigned]
    Added Reference http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/87327 [No Types Assigned]
  • Modified Analysis by [email protected]

    Nov. 01, 2016

    Action Type Old Value New Value
    Changed CPE Configuration Configuration 1 OR *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* Configuration 1 OR *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* Configuration 2 OR *cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:*
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Vendor Advisory
  • Initial Analysis by [email protected]

    Nov. 01, 2016

    Action Type Old Value New Value
    Changed CPE Configuration Configuration 1 OR *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* Configuration 1 OR *cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:* Configuration 2 OR *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Vendor Advisory
  • CVE Modified by [email protected]

    Oct. 26, 2016

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
  • Modified Analysis by [email protected]

    Aug. 18, 2016

    Action Type Old Value New Value
    Changed Reference Type http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec No Types Assigned http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory
    Changed Reference Type http://www.securitytracker.com/id/1035665 No Types Assigned http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
    Changed Reference Type http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html No Types Assigned http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory, Patch
    Changed Reference Type http://www.securityfocus.com/bid/91787 No Types Assigned http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
    Changed Reference Type http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html No Types Assigned http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Third Party Advisory, Exploit
  • CVE Modified by [email protected]

    Aug. 09, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/91787
  • CVE Modified by [email protected]

    Jul. 22, 2016

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
  • CVE Modified by [email protected]

    Jun. 01, 2016

    Action Type Old Value New Value
    Added Reference http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
    Added Reference http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
  • Modified Analysis by [email protected]

    May. 04, 2016

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*
    Added CVSS V2 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
    Added CVSS V3 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://struts.apache.org/docs/s2-032.html No Types Assigned https://struts.apache.org/docs/s2-032.html Advisory, Patch
    Added CWE CWE-77
  • Initial Analysis by [email protected]

    May. 02, 2016

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 8.1
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Base CVSS Score: 8.1
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Base CVSS Score: 9.3
Access Vector
Access Complexity
Authentication
Confidentiality Impact
Integrity Impact
Availability Impact
EPSS
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

96.52 }} 0.47%

score

0.99881

percentile