CVE-2023-34149

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Struts	<= 2.5.30; <= 6.1.2

References

http://www.openwall.com/lists/oss-security/2023/06/14/2Mailing List
https://cwiki.apache.org/confluence/display/WW/S2-063Vendor Advisory
https://security.netapp.com/advisory/ntap-20230706-0005/
http://www.openwall.com/lists/oss-security/2023/06/14/2Mailing List
https://cwiki.apache.org/confluence/display/WW/S2-063Vendor Advisory
https://security.netapp.com/advisory/ntap-20230706-0005/

Timeline

Published: Jun 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-341505.3** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.CVE-2023-341515.5A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and o CVE-2023-341529.8A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes con CVE-2023-341537.8A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-f CVE-2023-341548.2Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party a CVE-2023-341557.5Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability.CVE-2023-341565.3Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause ser CVE-2023-341576.5Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.CVE-2023-341585.3Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app CVE-2023-341599.8Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, CVE-2023-34167.2The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscr CVE-2023-341605.3Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app