CVE-2013-0248: Incorrect Default Permissions in Apache Commons FileUpload
Summary
CVE-2013-0248: Incorrect Default Permissions in Apache Commons FileUpload. Affects commons-fileupload:commons-fileupload versions >= 1.0, < 1.2.2. Fixed in 1.2.2. How to fix ↓
Also tracked for
- libcommons-fileupload-java · Debian:11
The same CVE-2013-0248 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a Java library used for uploading files in web applications. It provides functionality to handle file uploads and process the uploaded files. This vulnerability affects versions 1.0 through 1.2.2 of the library. The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload uses the /tmp directory for uploaded files. This can allow local users to overwrite arbitrary files on the system through an unspecified symlink attack.
Vulnerability Detail
The vulnerability arises from the use of the /tmp directory for storing uploaded files. By exploiting an unspecified symlink attack, local users can manipulate the file upload process and overwrite arbitrary files on the system. This can lead to unauthorized access, data loss, or even system compromise. The vulnerability has been assigned the CVE identifier CVE-2013-0248 and has a severity rating of LOW.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to manually configure the temporary directory used for file uploads. This can be done by setting the javax.servlet.context.tempdir property to a secure directory with appropriate permissions. Consult the documentation of your web application server or framework for instructions on how to configure the temporary directory.
Conclusion
The vulnerability in Apache Commons FileUpload (CVE-2013-0248) allows local users to overwrite arbitrary files on the system. It is recommended to upgrade to version 1.2.2 or later of the library to fix the vulnerability. If immediate upgrading is not possible, manually configuring the temporary directory used for file uploads can serve as a temporary workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commons-fileupload:commons-fileupload →
FAQ
Apache Commons FileUpload is a Java library used for handling file uploads in web applications. It provides functionality to parse and process uploaded files.
Versions 1.0 through 1.2.2 of Apache Commons FileUpload are affected by this vulnerability.
This vulnerability allows local users to overwrite arbitrary files on the system, potentially leading to unauthorized access, data loss, or system compromise.
Yes, this vulnerability has been assigned the CVE identifier CVE-2013-0248.
This vulnerability has a severity rating of LOW.
Related vulnerabilities
Recent vulnerabilities recorded for commons-fileupload:commons-fileupload.
