Apache Commons FileUpload denial of service vulnerability
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-24998US | high7.5 | Exploit | ||
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/05/22/1WEB
- https://commons.apache.org/proper/commons-fileupload/security-reports.htmlWEB
- https://github.com/apache/commons-fileuploadPACKAGE
- https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17WEB
- https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ceWEB
- https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6eWEB
- https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74WEB
- https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan