CVE-2023-24998
Assigner: apache
Published: 2023-02-20T15:57:07.372Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Commons FileUpload
vendor: Apache Software Foundation
versions: lessThan: 1.5
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: Apache Tomcat
vendor: Apache Software Foundation
versions: status: affected
version: 11.0.0-M1
lessThanOrEqual: 10.1.4
status: affected
version: 10.0.0-M1
versionType: semver
lessThanOrEqual: 9.0.70
status: affected
version: 9.0.0-M1
versionType: semver
lessThanOrEqual: 8.5.84
status: affected
version: 8.5.0
versionType: semver
credits: type: finder
value: Jakob Ackermann
descriptions: supportingMedia: base64: no
type: text/html
value: <div>Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.</div><div><br></div><div>Note that, like all of the file upload limits, the
          new configuration option (FileUploadBase#setFileCountMax) is not
          enabled by default and must be explicitly configured.<br></div>
value: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.




Note that, like all of the file upload limits, the
          new configuration option (FileUploadBase#setFileCountMax) is not
          enabled by default and must be explicitly configured.



metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
type: CWE
source: discovery: EXTERNAL
title: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
x_generator: engine: Vulnogram 0.1.0-dev