CVE-2016-3087: apache struts Improper Input Validation

CVSS: 9.8v3.0CriticalModified

AliasesGHSA-mmj6-cjj4-hpr5

Published 07-06-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-3087 is a critical (CVSS 9.8) Improper Input Validation vulnerability in apache struts. EPSS estimates a 81.87% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

81.87%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3exploit-database, metasploit

Timeline

07-06-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

81.87%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 81.87% on 18-09-2026

18-09-202618-10-2026

EPSS score

81.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaseremotemultipleUnverified
Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution
Maturity: poc
exploit-databaseremotemultipleVerified
Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
exploit/multi/http/struts_dmi_rest_exec
Maturity: weaponized