CVE-2023-24998: falha de alta gravidade em Apache Commons FileUpload
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 49%
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache Commons FileUploadApache Software Foundation · Apache TomcatCVEs relacionadas — Apache Commons FileUpload
No mesmo produto, das mais perigosas para as menos.
CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%
Referências
https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoyhttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2025/07/msg00008.htmlhttps://security.gentoo.org/glsa/202305-37https://security.netapp.com/advisory/ntap-20230302-0013/https://security.netapp.com/advisory/ntap-20241108-0002/https://www.debian.org/security/2023/dsa-5522http://www.openwall.com/lists/oss-security/2023/05/22/1