Apache Struts 2.0.9/2.1.8 - Session Tampering Security Bypass

Author: Hisato Killing
type: remote
platform: multiple
port: 
date_added: 2011-12-07 
date_updated: 2015-03-19 
verified: 1 
codes: CVE-2011-5057;OSVDB-77599 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/50940/info

Apache Struts is prone to a security-bypass vulnerability that allows session tampering.

Successful attacks will allow attackers to bypass security restrictions and gain unauthorized access.

Apache Struts versions 2.0.9 and 2.1.8.1 are vulnerable; other versions may also be affected.

http://www.example.com/SomeAction.action?session.somekey=someValue