Commons Fileupload
CVE-2016-1000031
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 4,436 maven packages depend on commons-fileupload:commons-fileupload (466 direct, 3,977 indirect)
Ecosystem-wide dependent count for version 1.3.3.
DescriptionCVE.org
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
AnalysisAI
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 56.4%.
Technical ContextAI
This vulnerability is classified under CWE-284. Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution Affected products include: Apache Commons Fileupload. Version information: before 1.3.3.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Commons Fileupload
View allMultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x bef
Apache Commons FileUpload contains a Denial of Service vulnerability in multipart header processing due to insufficient
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibi
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today