CVE-2014-0050highCWE-835

CVE-2014-0050

Published · Updated

Follow this CVE+ Monitor org.apache.tomcat:tomcat+ Monitor libcommons-fileupload-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 83%
from disclosure to weaponsame day
Published on NVDMar 28
1st PoCFeb 12
metasploitFeb 6
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
14 products (18 components)
Red Hat Software Collections · Red Hat JBoss Enterprise Web Server 1 · Red Hat JBoss Operations Network 3 · Red Hat BPM Suite 6 · Red Hat JBoss BRMS 5 · and others 9
none_available: Affected
Fixed
22 products (102 components)
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server · Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux HPC Node Optional (v. 6) · Red Hat Enterprise Linux Server (v. 6) · and others 17
fix ↗
Under investigation
1 product
Red Hat Enterprise Linux 5
Not affected
3 products (13 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat JBoss Data Grid 6 · Red Hat JBoss Data Virtualization 6
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.