CVE-2011-2088
XWork in Apache Struts Reveals Sensitive Information
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Exploit likelihood
What each source reports
NVD Score used
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- Record
CVE-2011-2088- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- Record
CVE-2011-2088- Updated
- 2026-11-02
EUVDEUVD-2022-3350 No score
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- Record
EUVD-2022-3350- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9ccm-g362-2r35 No score
XWork in Apache Struts Reveals Sensitive Information
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- Record
GHSA-9ccm-g362-2r35- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-9ccm-g362-2r35 No score
XWork in Apache Struts Reveals Sensitive Information
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
- Record
GHSA-9ccm-g362-2r35- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.2 | 2.2.2 |
org.apache.struts.xwork:xwork-coreMaven |
before 2.2.2, plus listed versions 2.2.12.2.1.1 |
2.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2088 is a medium vulnerability (CVSS 5.0) in Apache Struts, published May 13, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.14%, the 93rd percentile. Fixed in org.apache.struts.xwork:xwork-core 2.2.2.
References
issues.apache.org/jira/browse/WW-3579
secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
ventuneac.net/security-advisories/MVSA-11-006
securityfocus.com/archive/1/518066/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2011-2088