{"id":"CVE-2016-3087","published":"2016-06-07T18:00:00Z","modified":"2024-08-05T23:40:15Z","title":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28 contain a flaw in the REST Plugin's handling of the \"!\" (exclamation mark) operator. An attacker with network access to an affected application can execute arbitrary code by sending crafted requests, provided Dynamic Method Invocation is enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:24Z"},"cvss":null,"epss":{"score":0.81873,"percentile":0.99647,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securitytracker.com/id/1036017","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/39919/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://struts.apache.org/docs/s2-033.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21987854","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/90960","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.19, <2.3.20.3",">=2.3.21, <2.3.24.3",">=2.3.25, <2.3.28.1"],"patched":["2.3.20.3","2.3.24.3","2.3.28.1"],"from":["GHSA-mmj6-cjj4-hpr5"],"provenance":"source"}],"advisories":[{"id":"GHSA-mmj6-cjj4-hpr5","url":"https://github.com/advisories/GHSA-mmj6-cjj4-hpr5","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.19, <2.3.20.3"],"patched":["2.3.20.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-mmj6-cjj4-hpr5","url":"https://github.com/advisories/GHSA-mmj6-cjj4-hpr5","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.21, <2.3.24.3"],"patched":["2.3.24.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-mmj6-cjj4-hpr5","url":"https://github.com/advisories/GHSA-mmj6-cjj4-hpr5","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.3.25, <2.3.28.1"],"patched":["2.3.28.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-4592","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4592","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":39919,"url":"https://www.exploit-db.com/exploits/39919","title":"Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2016-06-10","verified":true,"provenance":"source"},{"id":43382,"url":"https://www.exploit-db.com/exploits/43382","title":"Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution","type":"remote","platform":"multiple","date":"2017-06-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2016-06-10"},"metasploit":[{"name":"Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution","module":"exploit/multi/http/struts_dmi_rest_exec","type":"exploit","disclosureDate":"2016-06-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.rb"}],"first":{"date":"2016-06-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/39919/","https://www.exploit-db.com/exploits/39919"],"flow":[],"timeline":[{"date":"2016-06-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2016-06-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.rb","provenance":"source"},{"date":"2016-06-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2016-3087","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9965"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 advisory exploit reference; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2016-2162","published":"2016-04-12","fixed":"2.3.28","kev":false,"link":{"from":"CVE-2016-2162","to":"CVE-2016-3087","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.28","toFixed":"2.3.28.1","daysApart":56}]}},{"cve":"CVE-2016-4003","published":"2016-04-12","fixed":"2.3.28","kev":false},{"cve":"CVE-2016-3081","published":"2016-04-26","fixed":"2.3.28.1","kev":true},{"cve":"CVE-2016-3082","published":"2016-04-26","fixed":"2.3.28.1","kev":false},{"cve":"CVE-2016-3087","published":"2016-06-07","fixed":"2.3.28.1","kev":false},{"cve":"CVE-2016-4438","published":"2016-07-04","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4461","published":"2017-10-16","fixed":"2.3.29","kev":false},{"cve":"CVE-2016-4436","published":"2016-10-03","fixed":"2.5.1","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}