Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
CVE-2023-34396

4.3MEDIUM

Key Information:

Vendor: Apache
Status: Apache Struts
Vendor: CVE Published:; 14 June 2023

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

Affected Version(s)

Apache Struts 0 <= 2.5.30

Apache Struts 0 <= 6.1.2

References

https://cwiki.apache.org/confluence/display/WW/S2-064

vendor-advisory

http://www.openwall.com/lists/oss-security/2023/06/14/3

https://security.netapp.com/advisory/ntap-20230706-0005/

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jun 14, 2023
Vulnerability Reserved
Jun 4, 2023

Credit

Matthew McClain