Apache Struts 2.3.20.x before 2.3.20.3, 2.3.24.x before 2.3.24.3, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
A vulnerability was reported in Apache Struts. A remote user can execute arbitrary code on the target system. A remote user can send a specially crafted expression via the REST interface to execute arbitrary code on the target system. Systems with the Dynamic Method Invocation and using the REST Plugin with '!' operation are affected.
