VulnerableCode Advisory Details - GHSA-7x9j-7223-rg5m

Staging Environment: Content and features may be unstable or change without notice.

Advisory details: github_osv / GHSA-7x9j-7223-rg5m

Essentials
Severities (2)
References (26)
Exploits (0)
EPSS
Severity details (1)
Patches: (0)

Advisory ID	github_osv/GHSA-7x9j-7223-rg5m
Aliases	CVE-2016-1000031
Summary	Improper Access Control in commons-fileupload Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Status	Published
Exploitability	0.5
Weighted Severity	8.8
Risk	4.4
Affected and Fixed Packages	Package Details
Introduced and Fixed Package Commit Patches	Package Commit Patches Details

Weaknesses (1)

CWE-284

Improper Access Control

System	Score	Found at
cvssv3	9.8	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-7x9j-7223-rg5m/GHSA-7x9j-7223-rg5m.json
generic_textual	CRITICAL

Reference id	Reference type	URL
		http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html
		https://github.com/advisories/GHSA-7x9j-7223-rg5m
		https://issues.apache.org/jira/browse/FILEUPLOAD-279
		https://issues.apache.org/jira/browse/WW-4812
		https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
		https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E
		https://nvd.nist.gov/vuln/detail/CVE-2016-1000031
		https://security.netapp.com/advisory/ntap-20190212-0001
		https://www.oracle.com/security-alerts/cpuapr2020.html
		https://www.oracle.com/security-alerts/cpujan2021.html
		https://www.oracle.com/security-alerts/cpuoct2020.html
		https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
		https://www.tenable.com/security/research/tra-2016-12
		https://www.tenable.com/security/research/tra-2016-23
		https://www.tenable.com/security/research/tra-2016-30
		http://www.securityfocus.com/bid/93604
		http://www.zerodayinitiative.com/advisories/ZDI-16-570
cpuapr2019-5072813.html	Other	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
cpujan2019-5072801.html	Other	https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
cpujan2020.html	Other	https://www.oracle.com/security-alerts/cpujan2020.html
cpujul2019-5072835.html	Other	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
cpujul2020.html	Other	https://www.oracle.com/security-alerts/cpujul2020.html
cpujul2022.html	Other	https://www.oracle.com/security-alerts/cpujul2022.html
cpuoct2018-4428296.html	Other	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
cpuoct2019-5072832.html	Other	https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
cpuoct2021.html	Other	https://www.oracle.com/security-alerts/cpuoct2021.html

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-7x9j-7223-rg5m/GHSA-7x9j-7223-rg5m.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.