CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
1 advisories matched
2016-04-26
Apache Struts 2 Dynamic Method Invocation (DMI) Remote Code Execution (CVE-2016-3081, S2-032)
[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.
[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.
[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.