WaratekVRT Sign in

CVE-2023-24998 Apache Commons FileUpload

Affected softwareApache Commons FileUpload
Severity7.5 High CVSS 3.1 2 scores
Fixed in1.5
WeaknessCWE-770
Published20 Feb 2023
Updated7 Oct 2026

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 49% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Apache Commons FileUpload 보안 취약점 테스트 4 2023-03-29

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists: apache/commons-fileupload e20c049.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Analytics / Development Operations (Apache Commons FileUpload) (7.6.0.0.0, 12.2.1.4.0)
Oracle Retail Applications / Core (Apache Commons FileUpload) (16.0.3.16)
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Analytics / Analytics Server (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Commerce / Workbench (Apache Commons FileUpload) (11.3.2)
Oracle Communications / Security (Apache Commons FileUpload) (46.6.4, 46.6.5)
Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Supply Chain / File Upload (Apache Commons FileUpload) (6.2.1.0-6.2.1.9)
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Supply Chain / Install (Apache Commons FileUpload) (6.5.2)
Oracle Systems / Tools (Apache Commons FileUpload) (4)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Financial Services Applications / Pricing Services (Apache Commons FileUpload) (5.0.0, 5.1.0)
Oracle Financial Services Applications / Reports (Apache Commons FileUpload) (8.1.2.5)
Oracle Retail Applications / Internal Operations (Apache Commons FileUpload) (18.0.0.14, 19.0.0.8)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Financial Services Applications / Installer (Apache Commons FileUpload) (8.1.2.3, 8.1.2.4)
Oracle Financial Services Applications / Security (Apache Commons FileUpload) (11.6-11.8, 11.10, 11.11)
Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Fusion Middleware / Install (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Fusion Middleware / Runtime Engine (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Retail Applications / Xenvironment (Apache Commons FileUpload) (18.0.5, 19.0.4, 20.0.3, 21.0.2, 22.0.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / Analytics Web Answers (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Commerce / Platform (Apache Commons FileUpload) (11.3.0, 11.3.1, 11.3.2)
Oracle Communications / Install/Upgrade (Apache Commons BeanUtils) (22.4.2, 23.1.0)
Oracle Communications / Install/Upgrade (Apache Commons FileUpload) (22.4.0, 23.1.0)
Oracle Communications / Install/Upgrade (Apache Commons FileUpload) (22.4.0, 23.1.0)
Oracle Communications Applications / Core (Apache Commons FileUpload) (5.5.0-5.5.16, 6.0.0-6.0.2)
Oracle Communications Applications / Mail Proxy (Apache Commons FileUpload) (3.0.3.2)
Oracle Communications Applications / Security (Apache Commons FileUpload) (7.3.5, 7.4.0, 7.4.1)
Oracle Communications Applications / Third Party (Apache Commons FileUpload) (8.0.0.2.0-8.0.0.7.0)
Oracle Communications Applications / Third Party (Apache Commons FileUpload) (8.0.0.6.0-8.0.0.8.0)
Oracle Construction and Engineering / Document Management (Apache Commons FileUpload) (18.8.0-18.8.18, 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.15, 22.12.0-22.12.6)
Oracle Enterprise Manager / Load Testing for Web Apps (Apache Commons FileUpload) (13.3.0.1)
Oracle Financial Services Applications / Accessibility (Apache Commons FileUpload) (14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Base (Apache Commons FileUpload) (14.4-14.7)
Oracle Financial Services Applications / Common (Apache Commons FileUpload) (14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Common (Apache Commons FileUpload) (14.7.1.0.0)
Oracle Financial Services Applications / Dashboard (Apache Commons FileUpload) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0)
Oracle Financial Services Applications / Onboarding Batch Processes (Apache Commons FileUpload) (14.6, 14.7)
Oracle Financial Services Applications / Platform (Apache Commons FileUpload) (8.0.7, 8.0.8, 8.1.0, 8.1.1, 8.1.2)
Oracle Financial Services Applications / Platform (Apache Commons FileUpload) (8.0.8)
Oracle Financial Services Applications / Platform (Apache Commons FileUpload) (8.0.8.1, 8.1.1.1, 8.1.2.4, 8.1.2.5)
Oracle Financial Services Applications / Reports (Apache Commons FileUpload) (14.5-14.7)
Oracle Financial Services Applications / Security (Apache Commons FileUpload) (14.7.0.2.0, 14.7.1.0.0)
Oracle Fusion Middleware / Installer (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (Apache Commons FileUpload) (12.2.1.4.0)
Oracle MySQL / Monitoring: General (Apache Commons FileUpload) (8.0.34 and prior)
Oracle Policy Automation / Determinations Engine (Apache Commons FileUpload) (Prior to 12.2.30)
Oracle Retail Applications / BDI Job Scheduler (Apache Commons FileUpload) (16.0.3, 19.0.1)
Oracle Retail Applications / RIB Kernal (Apache Commons FileUpload) (14.2.0, 15.0.4, 16.0.3, 19.0.1)
Oracle Retail Applications / RSB Installation (Apache Commons FileUpload) (14.2.0, 15.0.4, 16.0.3, 19.0.1)
Oracle Retail Applications / System Administration (Apache Commons FileUpload) (19.1)
Oracle Siebel CRM / Marketing (Apache Commons FileUpload) (23.4 and prior)
Oracle Spatial Studio / Oracle Spatial Studio (Apache Commons FileUpload) (22.3.0)
Oracle Supply Chain / Folders, Files and Attachments (Apache Commons FileUpload) (9.3.6)
Oracle Utilities Applications / General (Apache Commons FileUpload) (4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.0, 4.5.0.1.1)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Communications / BEServer (Apache Commons FileUpload) (9.0.0, 9.0.1)
Oracle Communications / BEServer (Apache Commons FileUpload) (9.0.0, 9.0.1)
Oracle Communications / Configuration (Apache Commons FileUpload) (23.1.0, 22.4.1)
Oracle Communications / Platform (Apache Commons FileUpload) (22.4.2, 23.1.0)
Oracle Database Server / Oracle Database Workload Manager (Apache Commons FileUpload) (21c)
Oracle Database Server / Spatial and Graph (Apache Commons Fileupload) (19c, 21c)
Oracle Financial Services Applications / IDM - Authentication (Apache Commons FileUpload) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2)
Oracle Financial Services Applications / UI General (Apache Commons FileUpload) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2)
Oracle Fusion Middleware / Console (Apache Commons FileUpload) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Third Party (Apache Commons FileUpload) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Third Party (Apache Commons FileUpload) (12.2.1.4.0)
Oracle Insurance Applications / Development Tools (Apache Commons FileUpload) (12.6.0.0.0, 12.6.2.0.0-12.6.4.0.0, 12.7.0.0.0, 12.7.1.0.0)
Oracle REST Data Services / Oracle REST Data Services (Apache Commons FileUpload) (Prior to 23.1.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Analytics Server (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Analytics Analytics Web Answers (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Analytics Development Operations (Apache Commons FileUpload) 7.6.0.0.0, 12.2.1.4.0 7.6.0.0.0 · 12.2.1.4.0
Oracle Commerce Platform (Apache Commons FileUpload) 11.3.0, 11.3.1, 11.3.2 11.3.0 · 11.3.1 · 11.3.2
Oracle Commerce Workbench (Apache Commons FileUpload) 11.3.2 11.3.2
Oracle Communications BEServer (Apache Commons FileUpload) 9.0.0, 9.0.1 9.0.0 · 9.0.1
Oracle Communications Configuration (Apache Commons FileUpload) 23.1.0, 22.4.1 22.4.1 · 23.1.0
Oracle Communications Install/Upgrade (Apache Commons BeanUtils) 22.4.2, 23.1.0 22.4.2 · 23.1.0
Oracle Communications Install/Upgrade (Apache Commons FileUpload) 22.4.0, 23.1.0 22.4.0 · 23.1.0
Oracle Communications Platform (Apache Commons FileUpload) 22.4.2, 23.1.0 22.4.2 · 23.1.0
Oracle Communications Security (Apache Commons FileUpload) 46.6.4, 46.6.5 46.6.4 · 46.6.5
Oracle Communications Applications Core (Apache Commons FileUpload) 5.5.0-5.5.16, 6.0.0-6.0.2
Oracle Communications Applications Mail Proxy (Apache Commons FileUpload) 3.0.3.2 3.0.3.2
Oracle Communications Applications Security (Apache Commons FileUpload) 7.3.5, 7.4.0, 7.4.1 7.3.5 · 7.4.0 · 7.4.1
Oracle Communications Applications Third Party (Apache Commons FileUpload) 8.0.0.2.0-8.0.0.7.0
Oracle Construction and Engineering Document Management (Apache Commons FileUpload) 18.8.0-18.8.18, 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.15, 22.12.0-22.12.6
Oracle Database Server Oracle Database Workload Manager (Apache Commons FileUpload) 21c 21
Oracle Database Server Spatial and Graph (Apache Commons Fileupload) 19c, 21c 19 · 21
Oracle Enterprise Manager Load Testing for Web Apps (Apache Commons FileUpload) 13.3.0.1 13.3.0.1
Oracle Financial Services Applications Accessibility (Apache Commons FileUpload) 14.7.0.2.0, 14.7.1.0.0 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Base (Apache Commons FileUpload) 14.4-14.7
Oracle Financial Services Applications Common (Apache Commons FileUpload) 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications Dashboard (Apache Commons FileUpload) 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications IDM - Authentication (Apache Commons FileUpload) 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2
Oracle Financial Services Applications Installer (Apache Commons FileUpload) 8.1.2.3, 8.1.2.4 8.1.2.3 · 8.1.2.4
Oracle Financial Services Applications Onboarding Batch Processes (Apache Commons FileUpload) 14.6, 14.7 14.6 · 14.7
Oracle Financial Services Applications Platform (Apache Commons FileUpload) 8.0.7, 8.0.8, 8.1.0, 8.1.1, 8.1.2 8.0.7 · 8.0.8 · 8.0.8.1 · 8.1.0 · 8.1.1 · 8.1.1.1 · 8.1.2 · 8.1.2.4 · 8.1.2.5
Oracle Financial Services Applications Pricing Services (Apache Commons FileUpload) 5.0.0, 5.1.0 5.0.0 · 5.1.0
Oracle Financial Services Applications Reports (Apache Commons FileUpload) 14.5-14.7 8.1.2.5
Oracle Financial Services Applications Security (Apache Commons FileUpload) 11.6-11.8, 11.10, 11.11 11.10 · 11.11 · 14.7.0.2.0 · 14.7.1.0.0
Oracle Financial Services Applications UI General (Apache Commons FileUpload) 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2
Oracle Fusion Middleware Centralized Thirdparty Jars (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Console (Apache Commons FileUpload) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Install (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Installer (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Engine (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Java agent for ODI (Apache Commons FileUpload) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party (Apache Commons FileUpload) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Insurance Applications Development Tools (Apache Commons FileUpload) 12.6.0.0.0, 12.6.2.0.0-12.6.4.0.0, 12.7.0.0.0, 12.7.1.0.0 12.6.0.0.0 · 12.7.0.0.0 · 12.7.1.0.0
Oracle MySQL Monitoring: General (Apache Commons FileUpload) 8.0.34 and prior
Oracle Policy Automation Determinations Engine (Apache Commons FileUpload) Prior to 12.2.30
Oracle REST Data Services Oracle REST Data Services (Apache Commons FileUpload) Prior to 23.1.0
Oracle Retail Applications BDI Job Scheduler (Apache Commons FileUpload) 16.0.3, 19.0.1 16.0.3 · 19.0.1
Oracle Retail Applications Core (Apache Commons FileUpload) 16.0.3.16 16.0.3.16
Oracle Retail Applications Internal Operations (Apache Commons FileUpload) 18.0.0.14, 19.0.0.8 18.0.0.14 · 19.0.0.8
Oracle Retail Applications RIB Kernal (Apache Commons FileUpload) 14.2.0, 15.0.4, 16.0.3, 19.0.1 14.2.0 · 15.0.4 · 16.0.3 · 19.0.1
Oracle Retail Applications RSB Installation (Apache Commons FileUpload) 14.2.0, 15.0.4, 16.0.3, 19.0.1 14.2.0 · 15.0.4 · 16.0.3 · 19.0.1
Oracle Retail Applications System Administration (Apache Commons FileUpload) 19.1 19.1
Oracle Retail Applications Xenvironment (Apache Commons FileUpload) 18.0.5, 19.0.4, 20.0.3, 21.0.2, 22.0.0 18.0.5 · 19.0.4 · 20.0.3 · 21.0.2 · 22.0.0
Oracle Siebel CRM Marketing (Apache Commons FileUpload) 23.4 and prior
Oracle Spatial Studio Oracle Spatial Studio (Apache Commons FileUpload) 22.3.0 22.3.0
Oracle Supply Chain File Upload (Apache Commons FileUpload) 6.2.1.0-6.2.1.9
Oracle Supply Chain Folders, Files and Attachments (Apache Commons FileUpload) 9.3.6 9.3.6
Oracle Supply Chain Install (Apache Commons FileUpload) 6.5.2 6.5.2
Oracle Systems Tools (Apache Commons FileUpload) 4 4
Oracle Utilities Applications General (Apache Commons FileUpload) 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.0, 4.5.0.1.1 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.5.0.0.0 · 4.5.0.1.0 · 4.5.0.1.1

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-fileupload:commons-fileupload 0 1.5 unbounded
org.apache.tomcat:tomcat-coyote 10.1.0-M1 10.1.5 unbounded
org.apache.tomcat:tomcat-coyote 11.0.0-M2 11.0.0-M5 unbounded
org.apache.tomcat:tomcat-coyote 8.5.85 8.5.88 unbounded
org.apache.tomcat:tomcat-coyote 9.0.0-M1 9.0.71 unbounded
org.apache.tomcat.embed:tomcat-embed-core 10.1.0-M1 10.1.5 unbounded
org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M2 11.0.0-M5 unbounded
org.apache.tomcat.embed:tomcat-embed-core 8.5.85 8.5.88 unbounded
org.apache.tomcat.embed:tomcat-embed-core 9.0.0-M1 9.0.71 unbounded
org.apache.tomcat:tomcat-catalina 10.1.0-M1 10.1.5 unbounded
org.apache.tomcat:tomcat-catalina 11.0.0-M2 11.0.0-M5 unbounded
org.apache.tomcat:tomcat-catalina 8.5.85 8.5.88 unbounded
org.apache.tomcat:tomcat-catalina 9.0.0-M1 9.0.71 unbounded

Products and versions

6 products, 17 version entries
SourceVendorProductSchemeAffected versions
nvd apache commons fileupload generic 1.0:beta · ≥ 1.0 and ＜ 1.5
osv commons-fileupload commons-fileupload generic ＜ 1.5
nvd debian debian linux generic 9.0 · 11.0
osv org.apache.tomcat tomcat-catalina generic ≥ 8.5.85 and ＜ 8.5.88 · ≥ 9.0.0 and ＜ 9.0.71 · ≥ 10.1.0 and ＜ 10.1.5 · ≥ 11.0.0 and ＜ 11.0.0
osv org.apache.tomcat tomcat-coyote generic ≥ 8.5.85 and ＜ 8.5.88 · ≥ 9.0.0 and ＜ 9.0.71 · ≥ 10.1.0 and ＜ 10.1.5 · ≥ 11.0.0 and ＜ 11.0.0
osv org.apache.tomcat.embed tomcat-embed-core generic ≥ 8.5.85 and ＜ 8.5.88 · ≥ 9.0.0 and ＜ 9.0.71 · ≥ 10.1.0 and ＜ 10.1.5 · ≥ 11.0.0 and ＜ 11.0.0

References

URLTags
https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17 WEB
https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce WEB
https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e WEB
https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74 WEB
https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38 WEB
https://www.debian.org/security/2023/dsa-5522 WEB
https://tomcat.apache.org/security-9.html WEB
https://tomcat.apache.org/security-8.html WEB
https://tomcat.apache.org/security-11.html WEB
https://tomcat.apache.org/security-10.html WEB

Timeline
Published2023-02-20By the CVE Program.
NVD record modified2026-10-07NVD's own last-modified date for this record.