جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

• http://www.securitytracker.com/id/1035665 vdb-entryx_refsource_SECTRACK
• https://struts.apache.org/docs/s2-032.html x_refsource_CONFIRM
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en x_refsource_CONFIRM
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html x_refsource_CONFIRM
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html x_refsource_CONFIRM
• http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec x_refsource_MISC
• https://www.exploit-db.com/exploits/39756/ exploitx_refsource_EXPLOIT-DB
• http://www.securityfocus.com/bid/91787 vdb-entryx_refsource_BID
• http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html x_refsource_MISC
• http://www.securityfocus.com/bid/87327 vdb-entryx_refsource_BID
• http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec x_refsource_MISC
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 government-resource