CVE-2023-41835

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-41835
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41835.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-41835
Aliases
Published
2023-12-05T08:37:31.602Z
Modified
2026-07-15T01:49:05.351437804Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Struts: excessive disk usage
Details

When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-459"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41835.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.5.31"
                },
                {
                    "introduced": "6.1.2.1"
                },
                {
                    "last_affected": "6.3.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5
Fixed
bfb6c5431b198ec9fafd7f4e4593a3b1e0c3a853
Introduced
28498a807d4741f1438aedf6da6a26fe8d20a97a
Fixed
236ae15c661659b3b06d6381941f95700fcb7e00
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.5.32"
        },
        {
            "introduced": "6.1.2.1"
        },
        {
            "fixed": "6.3.0.1"
        }
    ],
    "cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41835.json"