Apache Struts Denial of Service

Apache Struts is a popular Java-based framework used for building enterprise-level web applications. This vulnerability, known as the Apache Struts denial-of-service (DoS) issue, allows attackers to cause disk exhaustion by exploiting a file leak in multipart request processing.

You're affected if you use Denial of Service vulnerability. Affected versions: 7.0.3, 6.7.4

To fix this issue, upgrade to Apache Struts version 6.8.0 or 7.1.1 from the official Apache website: https://struts.apache.org/downloads.html. If an immediate upgrade isn't possible, consider the following mitigations:

• Restrict network access to your Struts instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• cve.org
• cwiki.apache.org