Advisory details:
github_osv / GHSA-xx68-jfcg-xmmf
| Advisory ID | github_osv/GHSA-xx68-jfcg-xmmf |
| Aliases |
CVE-2014-0050
|
| Summary | Commons FileUpload Denial of service vulnerability MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-20 | Improper Input Validation |
| System | Score | Found at |
|---|---|---|
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | This module triggers an infinite loop in Apache Commons FileUpload 1.0 through 1.3 via a specially crafted Content-Type header. Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50 and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also uses Commons FileUpload as part of the Manager application. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Feb. 6, 2014 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | Feb. 12, 2014 |
| Description | Apache Commons FileUpload and Apache Tomcat - Denial of Service |
| Ransomware campaign use | Known |
| Source publication date | Feb. 12, 2014 |
| Exploit type | dos |
| Platform | multiple |
| Source update date | Feb. 12, 2014 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.