Vulnerability in Apache Struts
CVE-2023-41835
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Struts
- Apache Software Foundation Struts — versions 2.0.0, 6.1.2.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (mailing-list, vendor-advisory, Mailing List, Release Notes)
- security@apache.org (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-41835?
- CVE-2023-41835 is a high-severity vulnerability in Apache Struts, classified under Incomplete Cleanup. CVSS score: 7.5/10. Published 2023-12-05.
- How severe is CVE-2023-41835?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-41835 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.