CVE-2016-3081: Apache Struts Command Injection Vulnerability

7IT reports that the five flaws hit Strapi (CVE-2023-22894), ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), ISC BIND (CVE-2015-5477) and ProFTPD (CVE-2015-3306)[1].According to security firm xHack, CVE-2016-3081 is a command-injection bug in Apache Struts, reported in 2016, that lets a remote attacker run code on a server when Dynamic Method Invocation is enabled[2]. The CVE Security database says CISA names this vulnerability "Apache Struts Command Injection Vulnerability"[3].The Strix vulnerability database says the flaw is rated 8.1/10 on the CVSS scale[4]. xHack notes that public exploit code exists[2], and exploit-intel.com lists a Metasploit exploit module for Apache Struts Dynamic Method Invocation Remote Code Execution[5].xHack writes that CISA's catalog does not say why it was added now[2]. Danny Mercer, an analyst at Innovation Network Design, reports that all five flaws have been used by Flax Typhoon, the China-linked operation that a seven-nation joint advisory now ties directly to Integrity Technolog[6]y Group.xHack says users should upgrade to 2.3.20.3, 2.3.24.3 or 2.3.28.1, or turn Dynamic Method Invocation off[2]. The site also reports that Apache and NVD disagree on the affected range[2].Mercer says that for everyone outside the federal space, the deadline is not binding, but the threat absolutely is[6].