Fluid Attacks Database

Description

Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.struts:struts2-config-browser-plugin	>=2.0.0 <2.5.32 \|\| >=6.1.2.1 <6.3.0.1	2.5.32, 6.3.0.1
maven	org.apache.struts:struts2-core	>=6.2.0 <6.3.0.1 \|\| >=6.0.0 <6.1.2.2 \|\| >=0 <2.5.32	6.3.0.1, 6.1.2.2, 2.5.32
maven	org.apache.struts:struts2-rest-plugin	>=2.0.0 <2.5.32 \|\| >=6.1.2.1 <6.3.0.1	2.5.32, 6.3.0.1
maven	org.apache.struts:struts2-struts1-plugin	>=2.0.0 <2.5.32 \|\| >=6.1.2.1 <6.3.0.1	-
maven	org.apache.struts:struts2-convention-plugin	>=2.0.0 <2.5.32 \|\| >=6.1.2.1 <6.3.0.1	2.5.32, 6.3.0.1
maven	struts:struts	>=2.0.0 <2.5.32 \|\| >=6.1.2.1 <6.3.0.1	2.5.32, 6.3.0.1

Aliases

1. CVE-2023-418352. NVD-2023-418353. OSV-2023-418354. GCVE-2023-41835

References

1. https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft2. https://www.openwall.com/lists/oss-security/2023/12/09/13. https://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a4. https://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac75. https://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d37116. https://security.netapp.com/advisory/ntap-20231013-00017. http://www.openwall.com/lists/oss-security/2023/12/09/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.