security.snyk.io Open in urlscan Pro
2a02:26f0:3500:88e::ecd  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Developer Tools
 * Snyk Learn
 * Snyk Advisor
 * Code Checker

About Snyk
 1. Snyk Vulnerability Database
 2. Maven
 3. commons-fileupload:commons-fileupload




ARBITRARY FILE WRITE AFFECTING COMMONS-FILEUPLOAD:COMMONS-FILEUPLOAD PACKAGE,
VERSIONS [,1.3.1)

--------------------------------------------------------------------------------

SEVERITY

Recommended
7.3
high
0
10

CVSS ASSESSMENT MADE BY SNYK'S SECURITY TEAM

Learn more


THREAT INTELLIGENCE



EPSS
1.35% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary File Write vulnerabilities in an interactive lesson.

Start learning
 * Snyk ID SNYK-JAVA-COMMONSFILEUPLOAD-30080
 * published 16 Jun 2013
 * disclosed 16 Jun 2013
 * credit Unknown

Report a new vulnerability Found a mistake?

INTRODUCED: 16 JUN 2013

CVE-2013-2186 Open this link in a new tab

CWE-20 Open this link in a new tab

Share



OVERVIEW

commons-fileupload:commons-fileupload Affected versions of this package are
vulnerable to Arbitrary File Write.


DETAILS

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss
BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web
Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte
in a file name in a serialized instance.


REFERENCES

 * Redhat Security Advisory
 * Redhat Bugzilla


CVSS SCORES

version 3.1
Expand this section


SNYK

7.3 high
 * Attack Vector (AV)
   Network
 * Attack Complexity (AC)
   Low
 * Privileges Required (PR)
   None
 * User Interaction (UI)
   None

 * Scope (S)
   Unchanged

 * Confidentiality (C)
   Low
 * Integrity (I)
   Low
 * Availability (A)
   Low

Expand this section


NVD

7.3 high
Expand this section


RED HAT

7.3 high


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * 
 * 
 * 
 * 


TRACK OUR DEVELOPMENT

 * 
 * 



© 2024 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.