Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
prionPRIOn knowledge basePRION:CVE-2023-41835
HistoryDec 05, 2023 - 9:15 a.m.

Design/Logic Flaw

2023-12-0509:15:00
PRIOn knowledge base
www.prio-n.com
6
multipart request
struts
logic flaw
fix
security issue
upgrade

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.003 Low

EPSS

Percentile

64.6%

JSON

When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Related

ubuntucve 1
osv 2
ibm 5
atlassian 2
nessus 2
github 1
veracode 1
f5 1
cve 1
openvas 1
cvelist 1
redhatcve 1
ubuntucve
ubuntucve
CVE-2023-41835
2023-12-05 00:00:00
osv
osv
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2023-12-05 09:33:27
CVE-2023-41835
2023-12-05 09:15:07
ibm
ibm
Security Bulletin: Struts vulnerability
2023-10-10 21:40:32
Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-41835)
2023-11-30 07:32:12
Security Bulletin: Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager.
2024-04-18 12:30:12
atlassian
atlassian
DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Confluence Data Center and Server
2024-01-17 06:46:18
DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Crowd Data Center and Server
2024-04-25 17:10:34
nessus
nessus
Atlassian Confluence 1.0.1 < 7.19.18 / 7.20.x < 8.5.5 / 8.6.x < 8.7.2 / 8.8.0 (CONFSERVER-94106)
2024-02-28 00:00:00
Apache Struts 2.0.0 < 2.5.32 / 6.0.0 < 6.3.0.1 Denial of Service (S2-065)
2023-09-13 00:00:00
github
github
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2023-12-05 09:33:27
veracode
veracode
Denial Of Services
2023-12-07 09:57:22
f5
f5
K000136957 : Apache struts vulnerability CVE-2023-41835
2023-09-22 00:00:00
cve
cve
CVE-2023-41835
2023-12-05 09:15:07
openvas
openvas
Apache Struts Security Update (S2-065)
2023-09-14 00:00:00
cvelist
cvelist
CVE-2023-41835 Apache Struts: excessive disk usage
2023-12-05 08:37:31
redhatcve
redhatcve
CVE-2023-41835
2023-12-05 12:40:10

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.003 Low

EPSS

Percentile

64.6%

JSON
Related for PRION:CVE-2023-41835
ubuntucve1osv2ibm5atlassian2nessus2github1veracode1f51cve1openvas1cvelist1redhatcve1