CVE-2016-3081 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99.88%

Affected Products (NVD)

Vendor	Product	Version
apache	struts	2.3.20 ≤ 𝑥 < 2.3.20.3
apache	struts	2.3.21 ≤ 𝑥 < 2.3.24.3
apache	struts	2.3.25 ≤ 𝑥 < 2.3.28.1
oracle	flexcube_private_banking	2.0.0.0
oracle	flexcube_private_banking	2.0.1
oracle	flexcube_private_banking	2.2.0
oracle	flexcube_private_banking	12.0.1
oracle	flexcube_private_banking	12.0.3
oracle	flexcube_private_banking	12.1.0
oracle	micros_retail_xbri_loss_prevention	10.0.1
oracle	micros_retail_xbri_loss_prevention	10.5.0
oracle	micros_retail_xbri_loss_prevention	10.6.0
oracle	micros_retail_xbri_loss_prevention	10.7.0
oracle	micros_retail_xbri_loss_prevention	10.8.0
oracle	micros_retail_xbri_loss_prevention	10.8.1
oracle	siebel_e-billing	7.1

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

libstruts1.2-java

artful	dne
bionic	dne
cosmic	dne
disco	dne
precise	ignored
trusty	dne
wily	dne
xenial	dne
yakkety	dne
zesty	dne

Known Exploits!

Common Weakness Enumeration

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Vulnerability Media Exposure

References

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec

http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec

http://www.securityfocus.com/bid/87327

http://www.securityfocus.com/bid/91787

http://www.securitytracker.com/id/1035665

https://struts.apache.org/docs/s2-032.html

https://www.exploit-db.com/exploits/39756/

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec

http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec

http://www.securityfocus.com/bid/87327

http://www.securityfocus.com/bid/91787

http://www.securitytracker.com/id/1035665

https://struts.apache.org/docs/s2-032.html

https://www.exploit-db.com/exploits/39756/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081