High
Security advisory
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-3081
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:48 UTC · Revision 1
Source evidence
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
osv:CVE-2016-3081
Complete source record
{
"id": "025afa3a993bbbc7e7be35988dcd9c5d7b61c1e6794a5bc229d0fdcc45260783",
"url": "https://osv.dev/vulnerability/CVE-2016-3081",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-3081",
"summary": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",
"evidence": "osv:CVE-2016-3081",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-3081",
"aliases": [
"CVE-2016-3081",
"GHSA-8c6j-ffmf-q6vm"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/struts",
"type": "GIT",
"events": [
{
"introduced": "0320310406f6b11cfd235d7a9b866cf1de483a1e"
},
{
"fixed": "bbbf43ec59e7bef3b07e9065dc9784c18a95d58b"
},
{
"introduced": "a40e9a90bf8b5039728ff312852991e7d580bff4"
},
{
"fixed": "36b6fff05cd4a17f75b091c0edd52e0c1e65ec06"
},
{
"introduced": "8ca0f2fc464f592fa95d8435d0924c3b9da981ef"
},
{
"fixed": "2cf0a7efeb12c8f476e31324dc56456b340ddeab"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.20"
},
{
"fixed": "2.3.20.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.21"
},
{
"fixed": "2.3.24.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.25"
},
{
"fixed": "2.3.28.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"STRUTS_2_3_28",
"STRUTS_2_3_20_2",
"STRUTS_2_3_20_1",
"STRUTS_2_3_27",
"STRUTS_2_3_26",
"STRUTS_2_3_25",
"STRUTS_2_3_20"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3081.json"
}
}
],
"modified": "2026-10-24T10:30:58.581114713Z",
"provider": "osv",
"references": [
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081",
"https://struts.apache.org/docs/s2-032.html",
"https://www.exploit-db.com/exploits/39756/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"
],
"vendor_product": "apache:struts",
"extracted_events": [
{
"range": [
{
"introduced": "2.3.20"
},
{
"fixed": "2.3.20.3"
},
{
"introduced": "2.3.21"
},
{
"fixed": "2.3.24.3"
},
{
"introduced": "2.3.25"
},
{
"fixed": "2.3.28.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:agile_controller-campus_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v100r002c00"
},
{
"last_affected": "v100r002c00"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:huawei:anyoffice:v200r005c00:*:*:*:*:*:*:*",
"cpe:2.3:a:huawei:anyoffice:v200r006c00:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:anyoffice",
"extracted_events": [
{
"range": [
{
"introduced": "v200r005c00"
},
{
"last_affected": "v200r005c00"
},
{
"introduced": "v200r006c00"
},
{
"last_affected": "v200r006c00"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:firehunter6000_firmware:v100r001c20:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:firehunter6000_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v100r001c20"
},
{
"last_affected": "v100r001c20"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:huawei:logcenter:v100r001c10:*:*:*:*:*:*:*",
"cpe:2.3:a:huawei:logcenter:v100r001c20:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:logcenter",
"extracted_events": [
{
"range": [
{
"introduced": "v100r001c10"
},
{
"last_affected": "v100r001c10"
},
{
"introduced": "v100r001c20"
},
{
"last_affected": "v100r001c20"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_18500_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18500f_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_18500f_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_18800_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_18800f_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_18800f_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5300_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_5300_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5500_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_5500_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5600_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_5600_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_5800_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_5800_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r001:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r002:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c00:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_6800_v3_firmware:v300r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_6800_v3_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v300r001"
},
{
"last_affected": "v300r001"
},
{
"introduced": "v300r002"
},
{
"last_affected": "v300r002"
},
{
"introduced": "v300r003c00"
},
{
"last_affected": "v300r003c00"
},
{
"introduced": "v300r003c10"
},
{
"last_affected": "v300r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c01:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_9000_firmware:v100r001c30:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r005c00:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_9000_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v100r001c01"
},
{
"last_affected": "v100r001c01"
},
{
"introduced": "v100r001c30"
},
{
"last_affected": "v100r001c30"
},
{
"introduced": "v300r005c00"
},
{
"last_affected": "v300r005c00"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c09spc505:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc205:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc900:*:*:*:*:*:*:*",
"cpe:2.3:o:huawei:oceanstor_n8500_firmware:v200r001c91spc901:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_n8500_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v200r001c09spc505"
},
{
"last_affected": "v200r001c09spc505"
},
{
"introduced": "v200r001c91spc205"
},
{
"last_affected": "v200r001c91spc205"
},
{
"introduced": "v200r001c91spc900"
},
{
"last_affected": "v200r001c91spc900"
},
{
"introduced": "v200r001c91spc901"
},
{
"last_affected": "v200r001c91spc901"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:huawei:oceanstor_onebox_firmware:v100r003c10:*:*:*:*:*:*:*"
],
"vendor_product": "huawei:oceanstor_onebox_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "v100r003c10"
},
{
"last_affected": "v100r003c10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:2.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:flexcube_private_banking",
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0.0"
},
{
"last_affected": "2.0.0.0"
},
{
"introduced": "2.0.1"
},
{
"last_affected": "2.0.1"
},
{
"introduced": "2.2.0"
},
{
"last_affected": "2.2.0"
},
{
"introduced": "12.0.1"
},
{
"last_affected": "12.0.1"
},
{
"introduced": "12.0.3"
},
{
"last_affected": "12.0.3"
},
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:micros_retail_xbri_loss_prevention",
"extracted_events": [
{
"range": [
{
"introduced": "10.0.1"
},
{
"last_affected": "10.0.1"
},
{
"introduced": "10.5.0"
},
{
"last_affected": "10.5.0"
},
{
"introduced": "10.6.0"
},
{
"last_affected": "10.6.0"
},
{
"introduced": "10.7.0"
},
{
"last_affected": "10.7.0"
},
{
"introduced": "10.8.0"
},
{
"last_affected": "10.8.0"
},
{
"introduced": "10.8.1"
},
{
"last_affected": "10.8.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:siebel_e-billing",
"extracted_events": [
{
"range": [
{
"introduced": "7.1"
},
{
"last_affected": "7.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-3081",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 439121,
"published_at": "2016-04-26T14:59:02.207+00:00"
}