{"id":"GHSA-9ccm-g362-2r35","summary":"XWork in Apache Struts Reveals Sensitive Information","details":"XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.","aliases":["CVE-2011-2088"],"modified":"2024-12-02T05:41:39.877949Z","published":"2022-05-14T02:55:17Z","database_specific":{"github_reviewed_at":"2023-08-17T21:57:55Z","nvd_published_at":"2011-05-13T17:05:00Z","cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2088"},{"type":"WEB","url":"https://github.com/apache/struts/commit/885ab3459e146ff830d1f7257f809f4a3dd4493a"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/WW-3579"},{"type":"WEB","url":"https://web.archive.org/web/20110726113612/http://www.ventuneac.net/security-advisories/MVSA-11-006"},{"type":"WEB","url":"https://web.archive.org/web/20201207174744/http://www.securityfocus.com/archive/1/518066/100/0/threaded"},{"type":"WEB","url":"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html"}],"affected":[{"package":{"name":"org.apache.struts.xwork:xwork-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.struts.xwork/xwork-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}],"versions":["2.2.1","2.2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9ccm-g362-2r35/GHSA-9ccm-g362-2r35.json"}}],"schema_version":"1.9.0"}