CVE-2016-3087

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

81.87% chance of exploitation in the next 30 days, 100th percentile

Published

2016-06-07

Updated

2024-08-05

Proof-of-concept exploits (1)

• aazard/Cyber_Security_Base_Project_II0★ · 2025-06-11

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/39919
• https://www.exploit-db.com/exploits/43382

References

• CVE Record
• NVD entry

Related

• CVE-2014-3120
• CVE-2015-8249
• CVE-2016-1209
• CVE-2016-3081
• CVE-2016-3088
• CVE-2016-3078