CVE-2023-41835 Apache Struts: excessive disk usage

2023-12-0508:37:31

CWE-459

apache

www.cve.org

apache struts

security vulnerability

excessive disk usage

upgrade recommendation

cve-2023-41835

multipart request

0.003 Low

EPSS

Percentile

66.3%

JSON

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.struts",
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.5.31",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "6.3.0",
        "status": "affected",
        "version": "6.1.2.1",
        "versionType": "semver"
      }
    ]
  }
]