Veracode Vulnerability DatabaseVERACODE:40909Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.015 Low
EPSS
Percentile
86.9%
Struts 2 Core is vulnerable to Denial Of Service (DoS). The vulnerability exists due to improper list bound checks during a multipart request with non-file form fields. An attacker can submit a crafted request, resulting in an out of memory error if the struts.multipart.maxSize is a value greater or equal to the available memory.
| CPE | Name | Operator | Version |
|---|---|---|---|
| struts 2 core | le | 6.1.2 | |
| struts 2 core | le | 2.5.30 | |
| struts 2 core | le | 6.1.2 | |
| struts 2 core | le | 2.5.30 |
References
www.openwall.com/lists/oss-security/2023/06/14/2
cwiki.apache.org/confluence/display/WW/S2-063
github.com/advisories/GHSA-8f6x-v685-g2xc
github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
github.com/apache/struts/commit/e58edfba83189fd17dcce94dc2be57a8b4e1571e
security.netapp.com/advisory/ntap-20230706-0005/
www.openwall.com/lists/oss-security/2023/06/14/2
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.015 Low
EPSS
Percentile
86.9%