Login Request a demo
Unscored severity · published May 13, 2011
CVE-2011-2088
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class…
–
CVSS
6.1%
EPSS
No
On KEV
Description
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.2.1 · source: NVD
WE
Webwork · Opensymphony
All versions, or not specified · source: NVD
XW
Xwork · Opensymphony
2.2.1 · source: NVD
Affected product
ST
Struts
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2088
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2088
secureappdev.blogspot.com
http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
secureappdev.blogspot.com
http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/518066/100/0/threaded
www.ventuneac.net
http://www.ventuneac.net/security-advisories/MVSA-11-006
Patch
https://issues.apache.org/jira/browse/WW-3579
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…