CVE-2023-24998
Last modified
CVE-2023-24998 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.. EPSS estimates a 46.84% chance of exploitation in the next 30 days.
Description
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Commons Fileupload | >= 1.0, < 1.5 | — |
| Apache | Commons Fileupload | 1.0 | Beta |
| Debian | Debian Linux | 9.0 | — |
| Debian | Debian Linux | 11.0 | — |
References
- https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyMailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlThird Party Advisory
- https://security.gentoo.org/glsa/202305-37Third Party Advisory
- https://www.debian.org/security/2023/dsa-5522Third Party Advisory
- https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyMailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlThird Party Advisory
- https://security.gentoo.org/glsa/202305-37Third Party Advisory
- https://www.debian.org/security/2023/dsa-5522Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-24998?
How severe is CVE-2023-24998?
How do I fix CVE-2023-24998?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-24992A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24993A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24994A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24995A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24996A vulnerability has been identified in Tecnomatix Plant Simu…7.8
- CVE-2023-24997Deserialization of Untrusted Data vulnerability in Apache So…9.8
- CVE-2023-24999HashiCorp Vault and Vault Enterprise’s approle auth method a…8.1
- CVE-2023-2500The Go Pricing - WordPress Responsive Pricing Tables plugin …8.8
- CVE-2023-25000HashiCorp Vault's implementation of Shamir's secret sharing …4.7
- CVE-2023-25001A maliciously crafted SKP file in Autodesk Navisworks 2023 a…7.8
- CVE-2023-25002A maliciously crafted SKP file in Autodesk products is used …7.8
- CVE-2023-25003A maliciously crafted pskernel.dll file in Autodesk AutoCAD …7.8
Are you affected by CVE-2023-24998?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST