PT-2023-3364 · Apache · Apache Struts

Matthew Mcclain

·

Published

2023-06-13

·

Updated

2023-07-06

·

CVE-2023-34149

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Apache Struts versions through 2.5.30 Apache Struts versions through 6.1.2
Description The issue is related to the allocation of resources without limits or throttling, which can lead to a denial of service via out of memory (OOM) due to not properly checking list bounds. When a Multipart request has non-file normal form fields, Struts brings them into memory as Strings without checking their sizes, potentially leading to OOM if the developer has set struts.multipart.maxSize to a value equal to or greater than the available memory.
Recommendations Upgrade to Struts 2.5.31 or 6.1.2.1 or greater. As a temporary workaround, consider setting a lower value for struts.multipart.maxSize to minimize the risk of exploitation. Restrict access to Multipart requests to minimize the risk of denial of service attacks.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2023-03520
CVE-2023-34149
GHSA-8F6X-V685-G2XC

Affected Products

Apache Struts