Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Remediation
References
http://struts.apache.org/docs/s2-033.html
http://www-01.ibm.com/support/docview.wss?uid=swg21987854
http://www.securityfocus.com/bid/90960
http://www.securitytracker.com/id/1036017
https://www.exploit-db.com/exploits/39919/
Related Vulnerabilities
CVE-2022-34158 Vulnerability in maven package org.apache.jspwiki:jspwiki-war
CVE-2018-8003 Vulnerability in maven package org.apache.ambari:ambari-server
CVE-2020-1744 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2019-10407 Vulnerability in maven package hudson.plugins:project-inheritance
CVE-2020-2161 Vulnerability in maven package org.jenkins-ci.main:jenkins-core