Source: cisa.gov
CVE-2016-3081 is a command injection vulnerability in Apache Struts that allows remote attackers to execute arbitrary code. The vulnerability is exploited via the 'method:' prefix when Dynamic Method Invocation (DMI) is enabled. It is tracked under the Struts advisory S2-032. The issue affects open-source components and third-party libraries that may be embedded in various products. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog. It is referenced under BOD 26-04, which prioritizes security updates based on risk. Organizations using Apache Struts with DMI enabled are urged to apply patches or mitigations immediately. The vulnerability carries a high criticality rating due to its potential for full remote code execution.
