NetSight
IP …
high7.5

CVE-2013-2186

Arbitrary file write in Apache Commons Fileupload

Impact

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Affected packages

EcosystemPackageAffectedFixed in
mavencommons-fileupload:commons-fileupload< 1.3.11.3.1

Affected products

VendorProductAffected versions
RedhatJboss Enterprise Brms Platform
Version 5.3.1
RedhatJboss Enterprise Portal Platform
Versions 4.3.0, 5.2.2, 6.0.0
RedhatJboss Enterprise Web Server
Version 1.0.2
RedhatOpenshift
through 3.1
UbuntuUbuntu
Version 10.04

Weakness classification

CWE-20

References