GitHub Advisoryadvisory · Maven
GHSA-9ccm-g362-2r35 XWork in Apache Struts Reveals Sensitive Information
MEDIUM
Official page ↗
- Aliases
- CVE-2011-2088
- Ecosystem
- Maven
- Packages
- org.apache.struts.xwork:xwork-core
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2023-08-17
Affected packages
• Maven org.apache.struts.xwork:xwork-core: < 2.2.2 → fixed in 2.2.2
Description
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Related
Alias · CVE (1)
- CVE-2011-2088 XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-2088 advisory
- https://github.com/apache/struts/commit/885ab3459e146ff830d1f7257f809f4a3dd4493a web
- https://issues.apache.org/jira/browse/WW-3579 web
- https://web.archive.org/web/20110726113612/http://www.ventuneac.net/security-advisories/MVSA-11-006 web
- https://web.archive.org/web/20201207174744/http://www.securityfocus.com/archive/1/518066/100/0/threaded web
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html web