VulnerabilityModified
CVE-2011-2088
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a…
MEDIUM 5.0EPSS 6.14%
Does this matter?
Lower severity and a low EPSS score (6.14%). Track it; it rarely justifies an emergency change on its own.
Description
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 6.14% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apache/struts · opensymphony/xwork · opensymphony/webwork
- Source
- cve@mitre.org
References
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- http://www.securityfocus.com/archive/1/518066/100/0/threaded
- http://www.ventuneac.net/security-advisories/MVSA-11-006
- https://issues.apache.org/jira/browse/WW-3579Patch
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- http://www.securityfocus.com/archive/1/518066/100/0/threaded
- http://www.ventuneac.net/security-advisories/MVSA-11-006
- https://issues.apache.org/jira/browse/WW-3579Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.