VYPR
← All advisories
Moderate severityNVD Advisory· Published May 13, 2011· Updated Apr 29, 2026

CVE-2011-2088

CVE-2011-2088

Description

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts.xwork:xwork-coreMaven
< 2.2.22.2.2

Affected products

4
  • Apache/Struts
    cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*
  • Opensymphony/Webwork
    cpe:2.3:a:opensymphony:webwork:-:*:*:*:*:*:*:*
  • Opensymphony/Xwork2 versions
    cpe:2.3:a:opensymphony:xwork:-:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:opensymphony:xwork:-:*:*:*:*:*:*:*
    • cpe:2.3:a:opensymphony:xwork:2.2.1:*:*:*:*:*:*:*

Patches

1
885ab3459e14

Solves WW-3579 - escapes actionName and methodName to prevent XSS vulnerability

https://github.com/apache/strutsLukasz LenartMar 2, 2011via ghsa
commit
1 file changed · +6 −6
  • xwork-core/src/main/java/com/opensymphony/xwork2/DefaultActionProxy.java+6 −6 modified
    @@ -23,12 +23,12 @@
 import com.opensymphony.xwork2.util.logging.Logger;
 import com.opensymphony.xwork2.util.logging.LoggerFactory;
 import com.opensymphony.xwork2.util.profiling.UtilTimerStack;
+import org.apache.commons.lang.StringEscapeUtils;
+import org.apache.commons.lang.StringUtils;
 
 import java.io.Serializable;
 import java.util.Locale;
 
-import org.apache.commons.lang.StringUtils;
-
 
 /**
  * The Default ActionProxy implementation
@@ -74,10 +74,10 @@ protected DefaultActionProxy(ActionInvocation inv, String namespace, String acti
 			LOG.debug("Creating an DefaultActionProxy for namespace " + namespace + " and action name " + actionName);
 		}
 
-		this.actionName = actionName;
-		this.namespace = namespace;
-		this.executeResult = executeResult;
-        this.method = methodName;
+        this.actionName = StringEscapeUtils.escapeHtml(actionName);
+        this.namespace = namespace;
+        this.executeResult = executeResult;
+        this.method = StringEscapeUtils.escapeJavaScript(StringEscapeUtils.escapeHtml(methodName));
     }
     
     @Inject

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.