PT-2023-7509 · Atlassian+1 · Confluence+1

Lukasz Lenart · Publicado 2023-09-13 · Atualizado 2024-02-20 · CVE-2023-41835

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.5.32 Apache Struts versions prior to 6.1.2.2 Apache Struts versions prior to 6.3.0.1 Confluence Data Center versions from 7.17.0 to 8.8.0 (excluding 8.8.0) Confluence Data Center versions from 8.0.0 to 8.0.4 Confluence Data Center versions from 8.1.0 to 8.1.4 Confluence Data Center versions from 8.2.0 to 8.2.3 Confluence Data Center versions from 8.3.0 to 8.3.4 Confluence Data Center versions from 8.4.0 to 8.4.5 Confluence Data Center versions from 8.5.0 to 8.5.4 Confluence Data Center versions from 8.6.0 to 8.6.1 Confluence Data Center versions from 8.7.0 to 8.7.1 Confluence Server versions from 7.17.0 to 8.5.4 Confluence Server versions from 8.0.0 to 8.0.4 Confluence Server versions from 8.1.0 to 8.1.4 Confluence Server versions from 8.2.0 to 8.2.3 Confluence Server versions from 8.3.0 to 8.3.4 Confluence Server versions from 8.4.0 to 8.4.5

Description When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. This issue may allow an unauthenticated attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, and high impact to availability.

Recommendations Upgrade Apache Struts to version 2.5.32 or greater. Upgrade Apache Struts to version 6.1.2.2 or greater. Upgrade Apache Struts to version 6.3.0.1 or greater. Upgrade Confluence Data Center to version 8.8.0 or greater. Upgrade Confluence Data Center to version 8.5.6 LTS or greater. Upgrade Confluence Server to version 8.5.6 LTS or greater. As a temporary workaround, consider restricting access to the struts.multipart.saveDir directory to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-913

CWE-459

Identificadores relacionados

BDU:2023-08554

CVE-2023-41835

GHSA-729Q-FCGP-R5XH

Produtos afetados

Apache Struts

Confluence

Referências · 20

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711 · Nota
• https://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7 · Nota
• https://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a · Nota
• https://twitter.com/oss_security/status/1733518133875392978 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-08554 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-41835 · Aviso do Fabricante
• https://t.me/cvenotify/63279 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/12/09/1 · Nota
• https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2023-41835 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2252931 · Nota
• https://security.netapp.com/advisory/ntap-20231013-0001 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-41835 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1732000091215466579 · Publicação no Twitter