Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Remediation
References
http://struts.apache.org/docs/s2-033.html
http://www.securityfocus.com/bid/90960
http://www.securitytracker.com/id/1036017
http://www-01.ibm.com/support/docview.wss?uid=swg21987854
https://www.exploit-db.com/exploits/39919/
Related Vulnerabilities
CVE-2010-5312 Vulnerability in maven package org.webjars:jquery-ui
CVE-2009-2901 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2017-1000389 Vulnerability in maven package org.jenkins-ci.plugins:plugin
CVE-2010-3863 Vulnerability in maven package org.jsecurity:jsecurity
CVE-2023-46589 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core