PT-2023-2276 · Apache+8 · Apache Commons Fileupload+9
Jakob Ackermann
·
Published
2023-01-19
·
Updated
2026-05-18
·
CVE-2023-24998
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Commons FileUpload versions prior to 1.5
Description
The issue is related to the unlimited distribution of resources, which can be exploited by an attacker to trigger a denial of service (DoS) with a malicious upload or series of uploads. This can be achieved by not limiting the number of request parts to be processed. A new configuration option,
FileUploadBase#setFileCountMax, is available but not enabled by default and must be explicitly configured.Recommendations
To resolve the issue, update Apache Commons FileUpload to version 1.5 or later.
As a temporary workaround, consider explicitly configuring the
FileUploadBase#setFileCountMax option to limit the number of request parts processed.Exploit
Fix
DoS
RCE
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Commons Fileupload
Apache Tomcat
Astra Linux
Centos
Debian
Red Hat
Red Os
Suse