CVE-2011-1772
Cross-site Scripting in Apache Struts
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
- Record
CVE-2011-1772- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
- Record
CVE-2011-1772- Updated
- 2026-11-02
EUVDEUVD-2022-2509 No score
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
- Record
EUVD-2022-2509- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-56f8-g68r-j699 No score
Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
- Record
GHSA-56f8-g68r-j699- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-56f8-g68r-j699 No score
Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
- Record
GHSA-56f8-g68r-j699- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.2.3 | 2.2.3 |
org.apache.struts:struts2-coreMaven |
before 2.2.3, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 10 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.1 |
2.2.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts 2.0.0 < 2.2.1.1 - XWork 's:submit' HTML Tag Cross-Site Scripting | 2011-05-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1772 is a low vulnerability (CVSS 2.6) in Apache Struts, published May 13, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.3%, the 98th percentile. Fixed in org.apache.struts:struts2-core 2.2.3.
References
vupen.com/english/advisories/2011/1198
securityfocus.com/bid/47784
struts.apache.org/2.x/docs/s2-006.html
jvndb.jvn.jp/jvndb/JVNDB-2011-000106
jvn.jp/en/jp/JVN25435092/index.html
secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
Show 7 moreShow less
ventuneac.net/security-advisories/MVSA-11-006
issues.apache.org/jira/browse/WW-3579
nvd.nist.gov/vuln/detail/CVE-2011-1772
github.com/advisories/GHSA-56f8-g68r-j699