CVEvulnerability
CVE-2011-2088
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-05-13
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Affected configurations
• apache struts 2.2.1
• opensymphony xwork 2.2.1
• opensymphony webwork
• opensymphony xwork
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html secureappdev.blogspot.com
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html secureappdev.blogspot.com
- http://www.securityfocus.com/archive/1/518066/100/0/threaded www.securityfocus.com
- http://www.ventuneac.net/security-advisories/MVSA-11-006 www.ventuneac.net
- https://issues.apache.org/jira/browse/WW-3579 Patch
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html secureappdev.blogspot.com
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html secureappdev.blogspot.com
- http://www.securityfocus.com/archive/1/518066/100/0/threaded www.securityfocus.com
- http://www.ventuneac.net/security-advisories/MVSA-11-006 www.ventuneac.net
- https://issues.apache.org/jira/browse/WW-3579 Patch