CVE-2013-2186
NoneCVSS
—
EPSS
12.7%
Published
Oct 28, 2013
CISA due date
—
The record
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | 0 | 1.3.1 |
| Debian:11 | libcommons-fileupload-java | 0 | 1.3-2.1 |
| Debian:12 | libcommons-fileupload-java | 0 | 1.3-2.1 |
| Debian:13 | libcommons-fileupload-java | 0 | 1.3-2.1 |
| Debian:6.0 | libcommons-fileupload-java | 0 | 1.2.2-1+deb6u1 |
| Debian:7 | libcommons-fileupload-java | 0 | 1.2.2-1+deb7u1 |
| Red Hat:jboss_enterprise_web_server:1::el5 | jakarta-commons-fileupload | 0 | 1:1.1.1-7.7.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el6 | jakarta-commons-fileupload | 0 | 1:1.1.1-7.7.ep5.el6 |
| Red Hat:openshift:3.1::el7 | atomic-openshift | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-clients | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-clients-redistributable | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-dockerregistry | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-master | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-node | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-pod | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-recycle | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-sdn-ovs | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-utils | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | heapster | 0 | 0:0.18.2-3.gitaf4752e.el7aos |
| Red Hat:openshift:3.1::el7 | jenkins | 0 | 0:1.625.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-align-text | 0 | 0:0.1.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ansi-green | 0 | 0:0.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ansi-wrap | 0 | 0:0.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-anymatch | 0 | 0:1.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arr-diff | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arr-flatten | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-array-unique | 0 | 0:0.2.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arrify | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-async-each | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-binary-extensions | 0 | 0:1.3.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-braces | 0 | 0:1.8.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-capture-stack-trace | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-chokidar | 0 | 0:1.4.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-configstore | 0 | 0:1.4.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-create-error-class | 0 | 0:2.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-deep-extend | 0 | 0:0.3.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-duplexer | 0 | 0:0.1.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-duplexify | 0 | 0:3.4.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-end-of-stream | 0 | 0:1.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-error-ex | 0 | 0:1.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-es6-promise | 0 | 0:3.0.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-event-stream | 0 | 0:3.3.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-expand-brackets | 0 | 0:0.1.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-expand-range | 0 | 0:1.8.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-extglob | 0 | 0:0.3.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-filename-regex | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-fill-range | 0 | 0:2.2.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-for-in | 0 | 0:0.1.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-for-own | 0 | 0:0.1.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-from | 0 | 0:0.1.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-glob-base | 0 | 0:0.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-glob-parent | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-got | 0 | 0:5.2.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-graceful-fs | 0 | 0:4.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ini | 0 | 0:1.1.0-6.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-binary-path | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-dotfile | 0 | 0:1.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-equal-shallow | 0 | 0:0.1.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-extendable | 0 | 0:0.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-extglob | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-glob | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-npm | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-number | 0 | 0:2.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-plain-obj | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-primitive | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-redirect | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-stream | 0 | 0:1.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-isobject | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-kind-of | 0 | 0:3.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-latest-version | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lazy-cache | 0 | 0:1.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.assign | 0 | 0:3.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.baseassign | 0 | 0:3.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.basecopy | 0 | 0:3.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.bindcallback | 0 | 0:3.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.createassigner | 0 | 0:3.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.defaults | 0 | 0:3.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.getnative | 0 | 0:3.9.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isarguments | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isarray | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isiterateecall | 0 | 0:3.0.9-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.keys | 0 | 0:3.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.restparam | 0 | 0:3.6.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lowercase-keys | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-map-stream | 0 | 0:0.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-micromatch | 0 | 0:2.3.5-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-mkdirp | 0 | 0:0.5.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-node-status-codes | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-nodemon | 0 | 0:1.8.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-normalize-path | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-object-assign | 0 | 0:4.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-object.omit | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-optimist | 0 | 0:0.4.0-5.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-os-homedir | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-os-tmpdir | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-osenv | 0 | 0:0.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-package-json | 0 | 0:2.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-parse-glob | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-parse-json | 0 | 0:2.2.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pause-stream | 0 | 0:0.0.11-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pinkie | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pinkie-promise | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-prepend-http | 0 | 0:1.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-preserve | 0 | 0:0.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ps-tree | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-randomatic | 0 | 0:1.1.5-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-rc | 0 | 0:1.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-read-all-stream | 0 | 0:3.0.1-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-readdirp | 0 | 0:2.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-regex-cache | 0 | 0:0.4.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-registry-url | 0 | 0:3.0.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-repeat-element | 0 | 0:1.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-semver | 0 | 0:5.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-semver-diff | 0 | 0:2.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-slide | 0 | 0:1.1.5-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-split | 0 | 0:0.3.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-stream-combiner | 0 | 0:0.2.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-string-length | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-strip-json-comments | 0 | 0:1.0.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-success-symbol | 0 | 0:0.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-through | 0 | 0:2.3.4-4.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-timed-out | 0 | 0:2.0.0-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-touch | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-undefsafe | 0 | 0:0.0.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-unzip-response | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-update-notifier | 0 | 0:0.6.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-url-parse-lax | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-uuid | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-write-file-atomic | 0 | 0:1.1.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-xdg-basedir | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nss_wrapper | 0 | 0:1.0.3-1.el7 |
| Red Hat:openshift:3.1::el7 | nss_wrapper-debuginfo | 0 | 0:1.0.3-1.el7 |
| Red Hat:openshift:3.1::el7 | openshift-ansible | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-docs | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-filter-plugins | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-lookup-plugins | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-playbooks | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-roles | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openvswitch | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-debuginfo | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-devel | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-test | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | origin-kibana | 0 | 0:0.5.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | python-openvswitch | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | tuned-profiles-atomic-openshift-node | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| maven | commons-fileupload/commons-fileupload | 1-alpha0 | No fix |
| openSUSE:Tumbleweed | apache-commons-fileupload | 0 | 1.4-1.9 |
Related vulnerabilities
- CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers Also affects commons-fileupload:commons-fileupload
- CVE-2023-24998 Apache Commons FileUpload before 1.5 does not limit the number of request parts to be… Also affects commons-fileupload:commons-fileupload
- CVE-2016-1000031 Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code… Also affects commons-fileupload:commons-fileupload
- CVE-2016-3092 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache… Also affects commons-fileupload:commons-fileupload
- CVE-2014-0050 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat… Also affects commons-fileupload:commons-fileupload
- CVE-2012-4557 The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker… Also affects jakarta-commons-fileupload
- CVE-2011-0419 Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the… Also affects jakarta-commons-fileupload
- CVE-2010-4172 Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache… Also affects jakarta-commons-fileupload