CVE-2023-41835

HIGH7.5EPSS 0.22%

Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability

發布日:2023/12/5修改日:2025/11/4

描述

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.

受影響套件(1)

Maven/org.apache.struts:struts2-core>= 6.2.0, < 6.3.0.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-41835
PATCHhttps://github.com/apache/struts
WEBhttps://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a
WEBhttps://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7
WEBhttps://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711
WEBhttps://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
WEBhttps://security.netapp.com/advisory/ntap-20231013-0001
WEBhttps://www.openwall.com/lists/oss-security/2023/12/09/1
WEBhttp://www.openwall.com/lists/oss-security/2023/12/09/1