CVE-2023-34149

2023-06-1408:15:09

Google

osv.dev

apache struts

vulnerability

resource allocation

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

86.9%

JSON

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

CPENameOperatorVersion
strutseqSTRUTS_2_5_4
strutseqSTRUTS_2_3_17
strutseqSTRUTS_2_5_8
strutseqSTRUTS_2_5_1
strutseqSTRUTS_2_5_9
strutseqSTRUTS_2_5_19
strutseqSTRUTS_2_3_20_1
strutseqSTRUTS_2_5_13
strutseqSTRUTS_2_5_27
strutseqSTRUTS_2_5_24

Name	Operator	Version
struts	eq	STRUTS_2_5_4
struts	eq	STRUTS_2_3_17
struts	eq	STRUTS_2_5_8
struts	eq	STRUTS_2_5_1
struts	eq	STRUTS_2_5_9
struts	eq	STRUTS_2_5_19
struts	eq	STRUTS_2_3_20_1
struts	eq	STRUTS_2_5_13
struts	eq	STRUTS_2_5_27
struts	eq	STRUTS_2_5_24