En bref
- CVE-2023-41835 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.apache.struts:struts2-core, struts (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 7.3%, plus élevée que 94.4% des vulnérabilités.
- Correctif : mettre à jour vers 6.1.2.2, 6.3.0.1, 2.5.32 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| org.apache.struts:struts2-core Maven | ≥ 6.0.0, < 6.1.2.2≥ 6.2.0, < 6.3.0.1< 2.5.32
| 6.1.2.26.3.0.12.5.32
|
| struts | ≥ 2.0.0, < 2.5.32≥ 6.1.2.1, < 6.3.0.1
| 2.5.326.3.0.1
|
Description
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.
NVD description
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Autres vulnérabilités de org.apache.struts:struts2-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free