CVE-2016-1000031
Critical · 9.8CVSS
9.8
EPSS
33.7%
Published
Oct 25, 2016
CISA due date
—
The record
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | 0 | 1.3.3 |
| Debian:10 | libcommons-fileupload-java | 0 | No fix |
| Debian:11 | libcommons-fileupload-java | 0 | No fix |
| Debian:12 | libcommons-fileupload-java | 0 | No fix |
| Debian:13 | libcommons-fileupload-java | 0 | No fix |
| SUSE:Enterprise Storage 4 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 | jakarta-commons-fileupload | 0 | 1.1.1-4.3.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | jakarta-commons-fileupload | 0 | 1.1.1-4.3.1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | jakarta-commons-fileupload | 0 | 1.1.1-1.37.3.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | jakarta-commons-fileupload | 0 | 1.1.1-1.37.3.1 |
| SUSE:Linux Enterprise Server 12 SP1-LTSS | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server 12 SP2-LTSS | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server 12 SP3 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server 12 SP4 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server 12-LTSS | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| SUSE:OpenStack Cloud 7 | jakarta-commons-fileupload | 0 | 1.1.1-122.3.1 |
| Ubuntu:16.04:LTS | libcommons-fileupload-java | 0 | No fix |
| Ubuntu:16.04:LTS | tomcat6 | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | tomcat6 | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libcommons-fileupload-java | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat6 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | 0 | No fix |
| openSUSE:Leap 15.0 | jakarta-commons-fileupload | 0 | 1.1.1-lp150.2.3.1 |
Related vulnerabilities
- CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers Also affects commons-fileupload:commons-fileupload
- CVE-2023-24998 Apache Commons FileUpload before 1.5 does not limit the number of request parts to be… Also affects commons-fileupload:commons-fileupload
- CVE-2016-3092 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache… Also affects commons-fileupload:commons-fileupload
- CVE-2014-0050 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat… Also affects commons-fileupload:commons-fileupload
- CVE-2013-2186 The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1… Also affects commons-fileupload:commons-fileupload
- CVE-2024-56337 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Also affects tomcat6
- CVE-2024-54677 Apache Tomcat Uncontrolled Resource Consumption vulnerability Also affects tomcat6
- CVE-2021-33037 Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not… Also affects tomcat6