Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 2 - Core | tomcat | 2024-04-11 01:07 | ALAS2-2024-2517 |
Amazon Linux 2 - Tomcat8.5 Extra | tomcat | 2023-08-21 20:58 | ALAS2TOMCAT8.5-2023-013 |
Amazon Linux 2 - Tomcat9 Extra | tomcat | 2023-08-21 20:58 | ALAS2TOMCAT9-2023-008 |
Amazon Linux 1 | tomcat7 | 2023-04-27 16:19 | ALAS-2023-1738 |
Amazon Linux 1 | tomcat8 | 2023-10-12 15:48 | ALAS-2023-1861 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | CVSSv3 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |