CVE-2023-24998: fallo de gravedad alta en Apache Commons FileUpload
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 49%
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Apache Software Foundation · Apache Commons FileUploadApache Software Foundation · Apache TomcatCVEs relacionadas — Apache Commons FileUpload
En el mismo producto, de las más peligrosas a las menos.
CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%
Referencias
https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyhttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2025/07/msg00008.htmlhttps://security.gentoo.org/glsa/202305-37https://security.netapp.com/advisory/ntap-20230302-0013/https://security.netapp.com/advisory/ntap-20241108-0002/https://www.debian.org/security/2023/dsa-5522http://www.openwall.com/lists/oss-security/2023/05/22/1