-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete file cleanup when multipart requests are denied. The commit diff shows critical changes in processNormalFormField where file item deletion was moved to a finally block. This indicates the original code path for size validation errors (size > maxStringLength) returned before reaching the item.delete() call, leaving temporary files. The CWE-459 (Incomplete Cleanup) mapping confirms this pattern matches the vulnerability description of residual files persisting after denied requests.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | >= 6.2.0, < 6.3.0.1 | 6.3.0.1 |
| org.apache.struts:struts2-core | maven | >= 6.0.0, < 6.1.2.2 | 6.1.2.2 |
| org.apache.struts:struts2-core |
| maven |
| < 2.5.32 |
| 2.5.32 |
Ongoing coverage of React2Shell