CVE-2016-3081

Fixed upstream ExploitedEPSS 97%CVSS 8.1

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Published 2016-04-26 · In CISA KEV since 2026-10-08 · CVE record · OSV

Products: huawei agile_controller-campus_firmware, huawei anyoffice, huawei logcenter, huawei firehunter6000_firmware, huawei oceanstor_5300_v3_firmware, huawei oceanstor_5500_v3_firmware, huawei oceanstor_5600_v3_firmware, huawei oceanstor_5800_v3_firmware, huawei oceanstor_6800_v3_firmware, huawei oceanstor_18500_v3_firmware, huawei oceanstor_18500f_firmware, huawei oceanstor_18800_v3_firmware, huawei oceanstor_18800f_firmware, huawei oceanstor_9000_firmware, huawei oceanstor_n8500_firmware, huawei oceanstor_onebox_firmware, apache struts, oracle flexcube_private_banking, oracle micros_retail_xbri_loss_prevention, oracle siebel_e-billing

Fixed upstream