CVE-2023-24998

Katalog CVE

CVSS 7.5 · High EPSS 48,8%

Kerentanan Allocation of Resources Without Limits or Throttling pada apache commons fileupload, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Rincian

Terbit di NVD

20 Februari 2023

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

48,8% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy mailing list · advisory vendor
• https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html advisory pihak ketiga
• https://security.gentoo.org/glsa/202305-37 advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5522 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/05/22/1 mailing list
• https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html
• https://security.netapp.com/advisory/ntap-20230302-0013/
• https://security.netapp.com/advisory/ntap-20241108-0002/