XWork in Apache Struts Reveals Sensitive Information

Description

References

• nvd.nist.gov/vuln/detail/CVE-2011-2088 · ADVISORY
• apache/struts commit 885ab34 · WEB
• issues.apache.org/jira/browse/WW-3579 · WEB
• web.archive.org/web/20110726113612/http://www.ventuneac.net/security-advisories/MVSA-11-006 · WEB
• web.archive.org/web/20201207174744/http://www.securityfocus.com/archive/1/518066/100/0/threaded · WEB
• secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html · WEB
• secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
• securityfocus.com/archive/1/518066/100/0/threaded
• ventuneac.net/security-advisories/MVSA-11-006

Weitere Schwachstellen in org.apache.struts.xwork:xwork-core

• CVE-2025-68493HOCH 8.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str…
• CVE-2016-4433HOCH 7.5Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a…
• CVE-2016-4430HOCH 8.8Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CS…
• CVE-2015-1831HOCH 7.5The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application"…
• CVE-2014-0094MITTEL 5.0The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, …