PT-2023-7509 · Atlassian+1 · Confluence+1

Lukasz Lenart · Published 2023-09-13 · Updated 2024-02-20 · CVE-2023-41835

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.5.32 Apache Struts versions prior to 6.1.2.2 Apache Struts versions prior to 6.3.0.1 Confluence Data Center versions from 7.17.0 to 8.8.0 (excluding 8.8.0) Confluence Data Center versions from 8.0.0 to 8.0.4 Confluence Data Center versions from 8.1.0 to 8.1.4 Confluence Data Center versions from 8.2.0 to 8.2.3 Confluence Data Center versions from 8.3.0 to 8.3.4 Confluence Data Center versions from 8.4.0 to 8.4.5 Confluence Data Center versions from 8.5.0 to 8.5.4 Confluence Data Center versions from 8.6.0 to 8.6.1 Confluence Data Center versions from 8.7.0 to 8.7.1 Confluence Server versions from 7.17.0 to 8.5.4 Confluence Server versions from 8.0.0 to 8.0.4 Confluence Server versions from 8.1.0 to 8.1.4 Confluence Server versions from 8.2.0 to 8.2.3 Confluence Server versions from 8.3.0 to 8.3.4 Confluence Server versions from 8.4.0 to 8.4.5

Description When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. This issue may allow an unauthenticated attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, and high impact to availability.

Recommendations Upgrade Apache Struts to version 2.5.32 or greater. Upgrade Apache Struts to version 6.1.2.2 or greater. Upgrade Apache Struts to version 6.3.0.1 or greater. Upgrade Confluence Data Center to version 8.8.0 or greater. Upgrade Confluence Data Center to version 8.5.6 LTS or greater. Upgrade Confluence Server to version 8.5.6 LTS or greater. As a temporary workaround, consider restricting access to the struts.multipart.saveDir directory to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-913

CWE-459

Related Identifiers

BDU:2023-08554

CVE-2023-41835

GHSA-729Q-FCGP-R5XH

Affected Products

Apache Struts

Confluence

References · 20

• https://bdu.fstec.ru/vul/2023-08554 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41835 · Vendor Advisory
• https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41835 · Security Note
• https://osv.dev/vulnerability/GHSA-729q-fcgp-r5xh · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711 · Note
• https://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7 · Note
• https://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a · Note
• https://twitter.com/oss_security/status/1733518133875392978 · Twitter Post
• https://t.me/cvenotify/63279 · Telegram Post
• http://openwall.com/lists/oss-security/2023/12/09/1 · Note
• https://access.redhat.com/security/cve/cve-2023-41835 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2252931 · Note
• https://security.netapp.com/advisory/ntap-20231013-0001 · Note