CVE-2023-41835

EUVD-2023-3135
When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
apachestruts
2.0.0 ≤
𝑥
< 2.5.32
apachestruts
6.1.2.1 ≤
𝑥
< 6.3.0.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libstruts1.2-java
bionic
ignored
focal
dne
jammy
dne
lunar
dne
mantic
dne
trusty
ignored
xenial
ignored
Common Weakness Enumeration
References
https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
https://www.openwall.com/lists/oss-security/2023/12/09/1
https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
https://security.netapp.com/advisory/ntap-20231013-0001/
https://www.openwall.com/lists/oss-security/2023/12/09/1