CVE-2023-24998

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_fileupload:1.0:beta:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

13 Feb 2025, 17:16

Type Values Removed Values Added
Summary (en) Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. (en) Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

21 Nov 2024, 07:48

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20230302-0013/ -
References () http://www.openwall.com/lists/oss-security/2023/05/22/1 - Mailing List () http://www.openwall.com/lists/oss-security/2023/05/22/1 - Mailing List
References () https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy - Mailing List, Vendor Advisory () https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy - Mailing List, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html - Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html - Third Party Advisory
References () https://security.gentoo.org/glsa/202305-37 - Third Party Advisory () https://security.gentoo.org/glsa/202305-37 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5522 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5522 - Third Party Advisory

16 Feb 2024, 19:11

Type Values Removed Values Added
First Time Debian
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References (MISC) https://security.gentoo.org/glsa/202305-37 - (MISC) https://security.gentoo.org/glsa/202305-37 - Third Party Advisory
References (MISC) https://www.debian.org/security/2023/dsa-5522 - (MISC) https://www.debian.org/security/2023/dsa-5522 - Third Party Advisory
References (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html - Third Party Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/05/22/1 - (MISC) http://www.openwall.com/lists/oss-security/2023/05/22/1 - Mailing List

13 Oct 2023, 16:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html -

11 Oct 2023, 07:15

Type Values Removed Values Added
References
  • (MISC) https://www.debian.org/security/2023/dsa-5522 -

30 May 2023, 06:16

Type Values Removed Values Added
References
  • (MISC) https://security.gentoo.org/glsa/202305-37 -

22 May 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/05/22/1 -
Summary Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Information

Published : 2023-02-20 16:15

Updated : 2025-02-13 17:16


NVD link : CVE-2023-24998

Mitre link : CVE-2023-24998

CVE.ORG link : CVE-2023-24998


JSON object : View

Products Affected

apache

  • commons_fileupload

debian

  • debian_linux
CWE
CWE-770

Allocation of Resources Without Limits or Throttling