PT-2023-21407 · Apache+1 · Apache Commons Fileupload+1

Jakob Ackermann · Published 2023-03-08 · Updated 2025-02-28 · CVE-2023-27901

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier

Description The issue allows attackers to trigger a denial of service by exploiting the Apache Commons FileUpload library without specified limits for the number of request parts in org.kohsuke.stapler.RequestImpl.

Recommendations For Jenkins versions 2.393 and earlier, update to a version that includes the fix for the denial of service issue. For Jenkins LTS versions 2.375.3 and earlier, update to a version that includes the fix for the denial of service issue. As a temporary workaround, consider restricting the number of request parts in the Apache Commons FileUpload library to minimize the risk of exploitation.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-JENKINS-2023-27901

CVE-2023-27901

GHSA-H76P-MC68-JV3P

RHSA-2023:3299

Affected Products

Apache Commons Fileupload

Jenkins

References · 10

• 🔥 https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27901.json · Exploit
• https://jenkins.io/security/advisory/2023-03-08/#SECURITY-3030 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h76p-mc68-jv3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27901 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2023-27901 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/b70f4cb5892bd6059a45b5f156f019ce572adb08 · Note
• https://t.me/cvenotify/112864 · Telegram Post
• https://t.me/cibsecurity/59851 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27901 · Note