CVE-2023-41835highCWE-459

CVE-2023-41835: falha de alta gravidade em Apache Struts

Apache Struts: excessive disk usage

Publicada em 05 dez 2023 · Atualizada em 04 nov 2025

Seguir esta CVE + Monitorar Apache Struts + Monitorar org.apache.struts:struts2-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 7.3%

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Produtos afetados

Apache Software Foundation · Apache Struts

CVEs relacionadas — Apache Struts

No mesmo produto, das mais perigosas para as menos.

CVE-2017-5638CRITICALCVE-2017-5638EPSS 100.0%KEV CVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEV CVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEV CVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEV CVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEV CVE-2017-12611—CVE-2017-12611EPSS 87.1%

Referências

https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft https://security.netapp.com/advisory/ntap-20231013-0001/https://www.openwall.com/lists/oss-security/2023/12/09/1