GoogleOSV:GHSA-8F6X-V685-G2XCApache Struts vulnerable to memory exhaustion
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.015 Low
EPSS
Percentile
86.9%
Denial of service via out of memory (OOM) owing to not properly checking of list bounds. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
References
www.openwall.com/lists/oss-security/2023/06/14/2
cwiki.apache.org/confluence/display/WW/S2-063
github.com/apache/struts
github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
github.com/apache/struts/releases/tag/STRUTS_2_5_31
github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
nvd.nist.gov/vuln/detail/CVE-2023-34149
security.netapp.com/advisory/ntap-20230706-0005
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.015 Low
EPSS
Percentile
86.9%