CVE-2016-3081: Apache Struts Command Injection Vulnerability

Published Apr 26, 2016
·
Updated

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Other sources

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

— CISA

Affected Software

140 affected componentsFixes available
maven/org.apache.struts:struts2-core>=2.3.21<=2.3.24.2
2.3.24.3
maven/org.apache.struts:struts2-core>=2.3.25<=2.3.28
2.3.28.1
maven/org.apache.struts:struts2-core>=2.3.19<=2.3.20.2
2.3.20.3
Apache Struts=2.0.0
Apache Struts=2.0.1
Apache Struts=2.0.2
Apache Struts=2.0.3
Apache Struts=2.0.4
Apache Struts=2.0.5
Apache Struts=2.0.6
Apache Struts=2.0.7
Apache Struts=2.0.8
Apache Struts=2.0.9
Apache Struts=2.0.10
Apache Struts=2.0.11
Apache Struts=2.0.11.1
Apache Struts=2.0.11.2
Apache Struts=2.0.12
Apache Struts=2.0.13
Apache Struts=2.0.14
Apache Struts=2.1.0
Apache Struts=2.1.1
Apache Struts=2.1.2
Apache Struts=2.1.3
Apache Struts=2.1.4
Apache Struts=2.1.5
Apache Struts=2.1.6
Apache Struts=2.1.8
Apache Struts=2.1.8.1
Apache Struts=2.2.1
Apache Struts=2.2.1.1
Apache Struts=2.2.3
Apache Struts=2.2.3.1
Apache Struts=2.3.1
Apache Struts=2.3.1.1
Apache Struts=2.3.1.2
Apache Struts=2.3.3
Apache Struts=2.3.4
Apache Struts=2.3.4.1
Apache Struts=2.3.7
Apache Struts=2.3.8
Apache Struts=2.3.12
Apache Struts=2.3.14
Apache Struts=2.3.14.1
Apache Struts=2.3.14.2
Apache Struts=2.3.14.3
Apache Struts=2.3.15
Apache Struts=2.3.15.1
Apache Struts=2.3.15.2
Apache Struts=2.3.15.3
Apache Struts=2.3.16
Apache Struts=2.3.16.1
Apache Struts=2.3.16.2
Apache Struts=2.3.16.3
Apache Struts=2.3.20
Apache Struts=2.3.20.1
Apache Struts=2.3.24
Apache Struts=2.3.24.1
Apache Struts=2.3.28
Oracle Siebel E-billing=7.1
Apache Struts
All of the following
Huawei Agile Controller-campus Firmware=v100r002c00
Huawei Agile Controller-Campus
Huawei AnyOffice=v200r005c00
Huawei AnyOffice=v200r006c00
Huawei LogCenter=v100r001c10
Huawei LogCenter=v100r001c20
All of the following
Huawei Firehunter6000 Firmware=v100r001c20
Huawei Firehunter6000
All of the following
Any of the following
Huawei Oceanstor 5300 V3 Firmware=v300r001
Huawei Oceanstor 5300 V3 Firmware=v300r002
Huawei Oceanstor 5300 V3 Firmware=v300r003c00
Huawei Oceanstor 5300 V3 Firmware=v300r003c10
Huawei Oceanstor 5300 V3
All of the following
Any of the following
Huawei Oceanstor 5500 V3 Firmware=v300r001
Huawei Oceanstor 5500 V3 Firmware=v300r002
Huawei Oceanstor 5500 V3 Firmware=v300r003c00
Huawei Oceanstor 5500 V3 Firmware=v300r003c10
Huawei Oceanstor 5500 V3
All of the following
Any of the following
Huawei Oceanstor 5600 V3 Firmware=v300r001
Huawei Oceanstor 5600 V3 Firmware=v300r002
Huawei Oceanstor 5600 V3 Firmware=v300r003c00
Huawei Oceanstor 5600 V3 Firmware=v300r003c10
Huawei OceanStor 5600 V3
All of the following
Any of the following
Huawei Oceanstor 5800 V3 Firmware=v300r001
Huawei Oceanstor 5800 V3 Firmware=v300r002
Huawei Oceanstor 5800 V3 Firmware=v300r003c00
Huawei Oceanstor 5800 V3 Firmware=v300r003c10
Huawei OceanStor 5800 V3
All of the following
Any of the following
Huawei Oceanstor 6800 V3 Firmware=v300r001
Huawei Oceanstor 6800 V3 Firmware=v300r002
Huawei Oceanstor 6800 V3 Firmware=v300r003c00
Huawei Oceanstor 6800 V3 Firmware=v300r003c10
Huawei Oceanstor 6800 V3
All of the following
Any of the following
Huawei Oceanstor 18500 V3 Firmware=v300r001
Huawei Oceanstor 18500 V3 Firmware=v300r002
Huawei Oceanstor 18500 V3 Firmware=v300r003c00
Huawei Oceanstor 18500 V3 Firmware=v300r003c10
Huawei Oceanstor 18500 V3
All of the following
Any of the following
Huawei Oceanstor 18500f Firmware=v300r001
Huawei Oceanstor 18500f Firmware=v300r002
Huawei Oceanstor 18500f Firmware=v300r003c00
Huawei Oceanstor 18500f Firmware=v300r003c10
Huawei Oceanstor 18500f=v3
All of the following
Any of the following
Huawei Oceanstor 18800 V3 Firmware=v300r001
Huawei Oceanstor 18800 V3 Firmware=v300r002
Huawei Oceanstor 18800 V3 Firmware=v300r003c00
Huawei Oceanstor 18800 V3 Firmware=v300r003c10
Huawei Oceanstor 18800 V3
All of the following
Any of the following
Huawei Oceanstor 18800f Firmware=v300r001
Huawei Oceanstor 18800f Firmware=v300r002
Huawei Oceanstor 18800f Firmware=v300r003c00
Huawei Oceanstor 18800f Firmware=v300r003c10
Huawei Oceanstor 18800f=v3
All of the following
Any of the following
Huawei Oceanstor 9000 Firmware=v100r001c01
Huawei Oceanstor 9000 Firmware=v100r001c30
Huawei Oceanstor 9000 Firmware=v300r005c00
Huawei Oceanstor 9000
All of the following
Any of the following
Huawei Oceanstor N8500 Firmware=v200r001c09spc505
Huawei Oceanstor N8500 Firmware=v200r001c91spc205
Huawei Oceanstor N8500 Firmware=v200r001c91spc900
Huawei Oceanstor N8500 Firmware=v200r001c91spc901
Huawei Oceanstor N8500
All of the following
Huawei Oceanstor Onebox Firmware=v100r003c10
Huawei Oceanstor Onebox
Apache Struts>=2.3.20<2.3.20.3
Apache Struts>=2.3.21<2.3.24.3
Apache Struts>=2.3.25<2.3.28.1
Oracle FLEXCUBE Private Banking=2.0.0.0
Oracle FLEXCUBE Private Banking=2.0.1
Oracle FLEXCUBE Private Banking=2.2.0
Oracle FLEXCUBE Private Banking=12.0.1
Oracle FLEXCUBE Private Banking=12.0.3
Oracle FLEXCUBE Private Banking=12.1.0
Oracle Micros Retail Xbri Loss Prevention=10.0.1
Oracle Micros Retail Xbri Loss Prevention=10.5.0
Oracle Micros Retail Xbri Loss Prevention=10.6.0
Oracle Micros Retail Xbri Loss Prevention=10.7.0
Oracle Micros Retail Xbri Loss Prevention=10.8.0
Oracle Micros Retail Xbri Loss Prevention=10.8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.apache.struts:struts2-core to a version that resolves this vulnerability.

    Fixed in 2.3.24.3
  2. Upgrade

    Upgrade maven/org.apache.struts:struts2-core to a version that resolves this vulnerability.

    Fixed in 2.3.28.1
  3. Upgrade

    Upgrade maven/org.apache.struts:struts2-core to a version that resolves this vulnerability.

    Fixed in 2.3.20.3
  4. Upgrade

    Upgrade Apache Struts to a version that resolves this vulnerability.

    Fixed in 2.3.20.2
  5. Upgrade

    Upgrade Apache Struts to a version that resolves this vulnerability.

    Fixed in 2.3.24.1
  6. Upgrade

    Upgrade Apache Struts to a version that resolves this vulnerability.

    Fixed in 2.3.28
  7. Compensating control

    Discontinue use of Apache Struts if mitigations are unavailable.

Event History

Apr 26, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
12:54 AM
Oct 8, 2026
Kev Listed
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2016-3081?

CVE-2016-3081 is classified as high severity due to its ability to allow remote code execution via dynamic method invocation.

2

How do I fix CVE-2016-3081?

To fix CVE-2016-3081, upgrade to Apache Struts version 2.3.20.3, 2.3.24.3, or 2.3.28.1.

3

What systems are affected by CVE-2016-3081?

CVE-2016-3081 affects Apache Struts versions 2.3.19 to 2.3.28 when Dynamic Method Invocation is enabled.

4

Can CVE-2016-3081 be exploited remotely?

Yes, CVE-2016-3081 can be exploited remotely by malicious actors to execute arbitrary code.

5

What is Dynamic Method Invocation in relation to CVE-2016-3081?

Dynamic Method Invocation is a feature in Apache Struts that, when enabled, can be exploited in CVE-2016-3081 to compromise the application.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203