Vulnerability DatabaseCVE-2023-41835
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2023-41835
December 05, 2023
When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Affected Packages
org.apache.struts:struts2-core (JAVA):
Affected version(s) >=2.0.5 <2.5.32
Fix Suggestion:
Update to version 2.5.32
org.apache.struts:struts2-core (JAVA):
Affected version(s) >=6.0.0 <6.1.2.2
Fix Suggestion:
Update to version 6.1.2.2
org.apache.struts:struts2-core (JAVA):
Affected version(s) >=6.2.0 <6.3.0.1
Fix Suggestion:
Update to version 6.3.0.1
Related Resources (10)
https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
https://www.openwall.com/lists/oss-security/2023/12/09/1
https://github.com/apache/struts
https://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a
http://www.openwall.com/lists/oss-security/2023/12/09/1
https://security.netapp.com/advisory/ntap-20231013-0001
https://nvd.nist.gov/vuln/detail/CVE-2023-41835
https://security.netapp.com/advisory/ntap-20231013-0001/
https://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711
https://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
Incomplete Cleanup
CWE-459
EPSS
Base Score:
0.22