Description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Remediation
References
http://struts.apache.org/docs/s2-033.html
http://www-01.ibm.com/support/docview.wss?uid=swg21987854
http://www.securityfocus.com/bid/90960
http://www.securitytracker.com/id/1036017
https://www.exploit-db.com/exploits/39919/
Related Vulnerabilities
CVE-2018-17186 Vulnerability in maven package org.apache.syncope.client:syncope-client-console
CVE-2022-34271 Vulnerability in maven package org.apache.atlas:atlas-intg
CVE-2017-5662 Vulnerability in maven package batik:batik-dom
CVE-2020-11989 Vulnerability in maven package org.apache.shiro:shiro-web
CVE-2019-17633 Vulnerability in maven package org.eclipse.che:assembly-wsmaster-war