{"id":"CVE-2011-2088","aliases":[],"url":"https://o3.security/vulnerability/CVE-2011-2088","summary":"XWork in Apache Struts Reveals Sensitive Information","details":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","published":"2022-05-14T02:55:17Z","modified":"2024-12-02T05:41:39.877949Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.struts.xwork:xwork-core","fixedVersion":"2.2.2"}],"fix":{"url":"https://github.com/apache/struts/commit/885ab3459e146ff830d1f7257f809f4a3dd4493a","label":"apache/struts@885ab34"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2088"},{"type":"WEB","url":"https://github.com/apache/struts/commit/885ab3459e146ff830d1f7257f809f4a3dd4493a"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/WW-3579"},{"type":"WEB","url":"https://web.archive.org/web/20110726113612/http://www.ventuneac.net/security-advisories/MVSA-11-006"},{"type":"WEB","url":"https://web.archive.org/web/20201207174744/http://www.securityfocus.com/archive/1/518066/100/0/threaded"},{"type":"WEB","url":"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-02T05:41:39.877949Z"}}