GoogleOSV:GHSA-8C6J-FFMF-Q6VMApache Struts RCE Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
References
packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
github.com/apache/struts
nvd.nist.gov/vuln/detail/CVE-2016-3081
struts.apache.org/docs/s2-032.html
web.archive.org/web/20210123152457/www.securityfocus.com/bid/91787
web.archive.org/web/20210225192113/www.securityfocus.com/bid/87327
web.archive.org/web/20210226011418/www.securitytracker.com/id/1035665
www.exploit-db.com/exploits/39756
Related
