CVE-2011-5057

Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."

• CWE-264

• http://codesecure.blogspot.com/2011/12/struts-2-session-tampering-via.htmlThird Party Advisory
• http://secunia.com/advisories/47109Permissions Required
• https://issues.apache.org/jira/browse/WW-2264Issue Tracking, Vendor Advisory
• https://issues.apache.org/jira/browse/WW-3631Issue Tracking, Vendor Advisory
• http://codesecure.blogspot.com/2011/12/struts-2-session-tampering-via.htmlThird Party Advisory
• http://secunia.com/advisories/47109Permissions Required
• https://issues.apache.org/jira/browse/WW-2264Issue Tracking, Vendor Advisory
• https://issues.apache.org/jira/browse/WW-3631Issue Tracking, Vendor Advisory

Published

Jan 8, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-5051Multiple unrestricted file upload vulnerabilities in the WP …
• CVE-2011-5052Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 all…
• CVE-2011-5053The Wi-Fi Protected Setup (WPS) protocol, when the "external…
• CVE-2011-5054kcheckpass passes a user-supplied argument to the pam_start …
• CVE-2011-5055MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS da…
• CVE-2011-5056The authoritative server in MaraDNS through 2.0.04 computes …
• CVE-2011-5058The CmbWebserver.dll module of the Control service in 3S CoD…
• CVE-2011-5059Stack-based buffer overflow in Final Draft 8 before 8.02 all…
• CVE-2011-5060The par_mktmpdir function in the PAR module before 1.003 for…
• CVE-2011-5061functions.php in WHMCompleteSolution (WHMCS) 4.0.x through 5…
• CVE-2011-5062The HTTP Digest Access Authentication implementation in Apac…
• CVE-2011-5063The HTTP Digest Access Authentication implementation in Apac…