CVE-2023-41835CWE-459

Apache Struts: excessive disk usage

High · published December 5, 2023

CVSS v3.1
7.5
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied.

Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.07300 · 94.4th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2023-12-05T08:37Z
EPSS history
Timeline
  • 05 DEC 08:37Z
    Apache Struts: excessive disk usage
    cvelistv5