CVE-2011-5057

CVE-2011-5057 describes a vulnerability in Apache Struts 2.3.1.2 and earlier, and versions 2.3.19-2.3.23, where certain interfaces (e.g., SessionAware, RequestAware) do not adequately restrict access to collections like session and request data. This allows remote attackers to modify run-time data values through crafted parameters. With a CVSS score of 5.0 (medium severity), this vulnerability has a low attack complexity and requires no authentication, potentially leading to unauthorized information modification. While the vendor disputes its significance due to an easy workaround, an exploit for session tampering in older Struts versions exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.