PT-2023-21407 · Apache+1 · Apache Commons Fileupload+1

Jakob Ackermann · Publicado 2023-03-08 · Atualizado 2025-02-28 · CVE-2023-27901

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier

Description The issue allows attackers to trigger a denial of service by exploiting the Apache Commons FileUpload library without specified limits for the number of request parts in org.kohsuke.stapler.RequestImpl.

Recommendations For Jenkins versions 2.393 and earlier, update to a version that includes the fix for the denial of service issue. For Jenkins LTS versions 2.375.3 and earlier, update to a version that includes the fix for the denial of service issue. As a temporary workaround, consider restricting the number of request parts in the Apache Commons FileUpload library to minimize the risk of exploitation.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-JENKINS-2023-27901

CVE-2023-27901

GHSA-H76P-MC68-JV3P

RHSA-2023:3299

Produtos afetados

Apache Commons Fileupload

Jenkins

Referências · 10

• 🔥 https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27901.json · Exploit
• https://github.com/jenkinsci/jenkins/commit/b70f4cb5892bd6059a45b5f156f019ce572adb08 · Nota
• https://jenkins.io/security/advisory/2023-03-08/#SECURITY-3030 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h76p-mc68-jv3p · Aviso do Fabricante
• https://t.me/cvenotify/112864 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27901 · Aviso do Fabricante
• https://t.me/cibsecurity/59851 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27901 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-jenkins-2023-27901 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27901 · Nota