CVE-2016-1000031 Improper Access Control in commons-fileupload
CriticalCVSS 9.8
EPSS 32.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| commons-fileupload/commons-fileupload(Maven) | < 1.3.3 | 1.3.3 |
| commons-fileupload/commons-fileupload(Maven) | = 1.0 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.0-beta-1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.0-rc1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.1.1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.2 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.2.1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.2.2 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.3 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.3.1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.3.1-jenkins-1 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.3.1-jenkins-2 | No fix listed |
| commons-fileupload/commons-fileupload(Maven) | = 1.3.2 | No fix listed |
| debian/libcommons-fileupload-java(Debian:12) | All versions | No fix listed |
| debian/libcommons-fileupload-java(Debian:12) | = 1.4-2 | No fix listed |
| debian/libcommons-fileupload-java(Debian:12) | = 1.5-1 | No fix listed |
| debian/libcommons-fileupload-java(Debian:12) | = 1.5-1.1 | No fix listed |
| debian/libcommons-fileupload-java(Debian:13) | All versions | No fix listed |
| debian/libcommons-fileupload-java(Debian:13) | = 1.5-1.1 | No fix listed |
| debian/libcommons-fileupload-java(Debian:14) | All versions | No fix listed |
| debian/libcommons-fileupload-java(Debian:14) | = 1.5-1.1 | No fix listed |
| apache commons fileupload | <= 1.3.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- issues.apache.org vendor-advisory
- issues.apache.org
- lists.apache.org
- lists.apache.org
- security.netapp.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.tenable.com third-party-advisory
- www.tenable.com third-party-advisory
- www.tenable.com third-party-advisory
- openSUSE-SU-2019:1399 vendor-advisory
- www.oracle.com
- 93604 third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- www.oracle.com
- www.oracle.com
- Debian Security Tracker CVE-2016-1000031 vendor-advisory
- [announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior mailing-list
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list