When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload
    files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended
    to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
    (CVE-2023-41835)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-94106 advisory.

  - This High severity org.apache.struts:struts2-core Dependency vulnerability was introduced in versions 1.0.1 of     Confluence Data Center and Server.(CVE-2023-41835)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Struts installed on the remote host is prior to 2.5.32 or 6.3.0.1. It is, therefore, affected by a vulnerability as referenced in the S2-065 advisory.

  - When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload     files will remain in struts.multipart.saveDir even if the request has been denied. (CVE-2023-41835)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
411735	SCA: security update for org.apache.struts:struts2-core (GHSA-729q-fcgp-r5xh)	Tenable Cloud Security	SCA Checks	high
411735	SCA: security update for org.apache.struts:struts2-core (GHSA-729q-fcgp-r5xh)	Tenable Self-Hosted Container Security	SCA Checks	high
191095	Atlassian Confluence 1.0.1 < 7.19.18 / 7.20.x < 8.5.5 / 8.6.x < 8.7.2 / 8.8.0 (CONFSERVER-94106)	Nessus	CGI abuses	high
181347	Apache Struts 2.0.0 < 2.5.32 / 6.0.0 < 6.3.0.1 Denial of Service (S2-065)	Nessus	Misc.	high

Detections

Analytics

CVE-2023-41835

high

Tenable Plugins

high

high

high

high