PT-2023-21406 · Apache+1 · Apache Commons Fileupload+1

Jakob Ackermann

·

Published

2023-03-08

·

Updated

2025-02-28

·

CVE-2023-27900

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier
Description The issue is related to the use of the Apache Commons FileUpload library without specifying limits for the number of request parts, allowing attackers to trigger a denial of service. This library is used to process uploaded files via the Stapler web framework and MultipartFormDataParser in Jenkins. Attackers can cause a denial of service by sending crafted requests to HTTP endpoints processing file uploads.
Recommendations For Jenkins versions 2.393 and earlier, update to version 2.394 or later to limit the number of request parts to be processed. For Jenkins LTS versions 2.375.3 and earlier, update to version 2.375.4 or later to limit the number of request parts to be processed. As a temporary workaround, consider restricting access to HTTP endpoints that process file uploads to minimize the risk of exploitation.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-JENKINS-2023-27900
CVE-2023-27900
GHSA-FRGR-C5F2-8QHH
RHSA-2023:3299

Affected Products

Apache Commons Fileupload
Jenkins