{"id":"CVE-2011-2088","aliases":["EUVD-2022-3350","GHSA-9ccm-g362-2r35"],"status":"published","title":"XWork in Apache Struts Reveals Sensitive Information","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0614,"percentile":0.93502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2011-05-13T17:00:00Z","modified":"2026-06-16T23:30:40Z","fixes":[{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","fixed_in":["2.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}],"versions":["2.2.1","2.2.1.1"]}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"opensymphony","product":"webwork"},{"vendor":"opensymphony","product":"xwork"}],"references":[{"url":"https://issues.apache.org/jira/browse/WW-3579","tags":["x_refsource_MISC","x_transferred","Patch","web"]},{"url":"http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.ventuneac.net/security-advisories/MVSA-11-006","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/518066/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2088","tags":["advisory"]},{"url":"https://github.com/apache/struts/commit/885ab3459e146ff830d1f7257f809f4a3dd4493a","tags":["web"]},{"url":"https://web.archive.org/web/20110726113612/http://www.ventuneac.net/security-advisories/MVSA-11-006","tags":["web"]},{"url":"https://web.archive.org/web/20201207174744/http://www.securityfocus.com/archive/1/518066/100/0/threaded","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9ccm-g362-2r35"}],"sources":{"cve":[{"id":"CVE-2011-2088","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","status":"published","published":"2011-05-13T17:00:00Z","modified":"2024-08-06T22:46:00.961Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2022-3350","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","status":"published","published":"2011-05-13T17:00:00Z","modified":"2024-08-06T22:46:00Z","updated_at":"2026-11-03T01:55:54.133107Z"}],"ghsa":[{"id":"GHSA-9ccm-g362-2r35","title":"XWork in Apache Struts Reveals Sensitive Information","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","status":"published","published":"2022-05-14T02:55:17Z","modified":"2023-08-17T21:58:11Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:00.074932Z"}],"nvd":[{"id":"CVE-2011-2088","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","status":"published","published":"2011-05-13T17:05:45.283Z","modified":"2026-06-16T23:30:40.277Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:08.47516Z"}],"osv":[{"id":"GHSA-9ccm-g362-2r35","title":"XWork in Apache Struts Reveals Sensitive Information","description":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","status":"published","published":"2022-05-14T02:55:17Z","modified":"2024-12-02T05:41:39.877949Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:43.524801Z"}]}}