Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache
    Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or
    6.1.2.1 or greater (CVE-2023-34396)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (OpenSSL)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-2650)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2023-20862)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Commons FileUpload)). Supported versions that are affected are 8.0.34 and prior. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2023-24998)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-28709)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Ivy)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all MySQL Enterprise Monitor accessible data and unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2022-37865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Struts installed on the remote host is prior to 2.5.31 or 6.1.2.1. It is, therefore, affected by a vulnerability as referenced in the S2-064 advisory.

  - When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings     without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a     value equal or greater than the available memory. (CVE-2023-34396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410159	SCA: security update for org.apache.struts:struts2-core (GHSA-4g42-gqrg-4633)	Tenable Cloud Security	SCA Checks	high
410159	SCA: security update for org.apache.struts:struts2-core (GHSA-4g42-gqrg-4633)	Tenable Self-Hosted Container Security	SCA Checks	high
178719	Oracle MySQL Enterprise Monitor (Jul 2023 CPU)	Nessus	CGI abuses	critical
177225	Apache Struts < 2.5.31 / 6.1.2.1 Denial of Service (S2-064)	Nessus	Misc.	high

Detections

Analytics

CVE-2023-34396

high

Tenable Plugins

high

high

critical

high