NetSight
IP …
high7.5Public exploit code

CVE-2014-0050

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a den…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Affected products

VendorProductAffected versions
OracleRetail Applications
Versions 12.0, 12.0in, 13.0, 13.1, 13.2, 13.3
ApacheCommons Fileupload
through 1.3
Versions 1.0, 1.1, 1.1.1, 1.2, 1.2.1
ApacheTomcat
Versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5

Weakness classification

CWE-264CWE-835

References