GitHub Advisoryadvisory · Maven

GHSA-729q-fcgp-r5xh Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability

HIGH Published 2023-12-05 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-41835
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-459
Reviewed
2023-12-05

Affected packages

• Maven org.apache.struts:struts2-core: >= 6.2.0, < 6.3.0.1 → fixed in 6.3.0.1 • Maven org.apache.struts:struts2-core: >= 6.0.0, < 6.1.2.2 → fixed in 6.1.2.2 • Maven org.apache.struts:struts2-core: < 2.5.32 → fixed in 2.5.32

Description

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2023-41835 When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in… vulnerability

Weakness · CWE (1)

  • CWE-459 Incomplete Cleanup weakness

References