CVE-2016-3081: Struts (Apache)
Vulnerabilità già sfruttata in attacchi reali, punteggio 8,1 su 10, in Struts (Apache). Sfruttabile da remoto, via rete, senza credenziali, senza che nessuno faccia nulla. Tipo: iniezione di comandi.
- Gravità
- 8,1 su 10 (high)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Sfruttamento
- Sfruttata in attacchi reali (catalogo CISA KEV).
- Scadenza CISA
- Le agenzie federali USA devono correggerla entro il 11 ottobre 2026: un buon riferimento anche per voi.
- Tipo di difetto
- CWE-77: iniezione di comandi
- Pubblicata
- 26 aprile 2016
Descrizione originale
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Fonti
- Scheda NVD
- packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec