CVE-2023-34396: Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

Reference Links

• http://www.openwall.com/lists/oss-security/2023/06/14/3
• https://cwiki.apache.org/confluence/display/WW/S2-064
• https://security.netapp.com/advisory/ntap-20230706-0005/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/257946
• https://www.ibm.com/support/pages/node/7049133 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7049133

Frequently Asked Questions

• What is the vulnerability ID of this Apache Struts vulnerability?

  The vulnerability ID is CVE-2023-34396.

• What is the severity of CVE-2023-34396?

  The severity of CVE-2023-34396 is high with a severity value of 7.5.

• How does the vulnerability in Apache Struts affect IBM QRadar SIEM?

  The vulnerability affects IBM QRadar SIEM version 7.5.0 - 7.5.0 UP6.

• What is the impact of CVE-2023-34396?

  The vulnerability can be exploited by a remote attacker to cause a denial of service condition.

• Where can I find more information about CVE-2023-34396?

  You can find more information about CVE-2023-34396 at the following references: [Reference 1](https://exchange.xforce.ibmcloud.com/vulnerabilities/257946), [Reference 2](https://www.ibm.com/support/pages/node/7049133).