{"action":"Upgrade org.apache.struts:struts2-core to the fixed version for your line (see fixed_versions).","affected":[{"fixed":"2.3.20.3","introduced":"2.3.19"},{"fixed":"2.3.24.3","introduced":"2.3.21"},{"fixed":"2.3.28.1","introduced":"2.3.25"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2016-3081"],"ecosystem":"Maven","epss":0.96525,"exploited":true,"fixed_versions":["2.3.20.3","2.3.24.3","2.3.28.1"],"ghsa_id":"GHSA-8c6j-ffmf-q6vm","id":"tcs_01M5N8MF0WYXDMP61WWBE038DR","modified_at":"2024-02-16T08:16:46.290501Z","published_at":"2022-05-14T00:54:14Z","references":["https://osv.dev/vulnerability/GHSA-8c6j-ffmf-q6vm","https://nvd.nist.gov/vuln/detail/CVE-2016-3081","https://github.com/apache/struts","https://struts.apache.org/docs/s2-032.html","https://web.archive.org/web/20210123152457/http://www.securityfocus.com/bid/91787","https://web.archive.org/web/20210225192113/http://www.securityfocus.com/bid/87327","https://web.archive.org/web/20210226011418/http://www.securitytracker.com/id/1035665","https://www.exploit-db.com/exploits/39756","http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec","http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8c6j-ffmf-q6vm","url":"https://osv.dev/vulnerability/GHSA-8c6j-ffmf-q6vm"},{"source":"kev","source_id":"CVE-2016-3081","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Apache Struts RCE Vulnerability"}