CVEvulnerability

CVE-2014-0050

7.5 HIGH Published 2014-04-01 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2014-04-01
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-264, CWE-835

Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Affected configurations

• oracle retail applications 12.0 • oracle retail applications 12.0in • oracle retail applications 13.0 • oracle retail applications 13.1 • oracle retail applications 13.2 • oracle retail applications 13.3 • oracle retail applications 13.4 • oracle retail applications 14.0 • apache commons fileupload (<= 1.3) • apache commons fileupload 1.0 • apache commons fileupload 1.1 • apache commons fileupload 1.1.1 • apache commons fileupload 1.2 • apache commons fileupload 1.2.1 • apache commons fileupload 1.2.2 • apache tomcat 7.0.0 • apache tomcat 7.0.1 • apache tomcat 7.0.2 • apache tomcat 7.0.3 • apache tomcat 7.0.4 • apache tomcat 7.0.5 • apache tomcat 7.0.6 • apache tomcat 7.0.7 • apache tomcat 7.0.8 • apache tomcat 7.0.9 • apache tomcat 7.0.10 • apache tomcat 7.0.11 • apache tomcat 7.0.12 • apache tomcat 7.0.13 • apache tomcat 7.0.14 • apache tomcat 7.0.15 • apache tomcat 7.0.16 • apache tomcat 7.0.17 • apache tomcat 7.0.18 • apache tomcat 7.0.19 • apache tomcat 7.0.20 • apache tomcat 7.0.21 • apache tomcat 7.0.22 • apache tomcat 7.0.23 • apache tomcat 7.0.24 • apache tomcat 7.0.25 • apache tomcat 7.0.26 • apache tomcat 7.0.27 • apache tomcat 7.0.28 • apache tomcat 7.0.29 • apache tomcat 7.0.30 • apache tomcat 7.0.31 • apache tomcat 7.0.32 • apache tomcat 7.0.33 • apache tomcat 7.0.34 • apache tomcat 7.0.35 • apache tomcat 7.0.36 • apache tomcat 7.0.37 • apache tomcat 7.0.38 • apache tomcat 7.0.39 • apache tomcat 7.0.40 • apache tomcat 7.0.41 • apache tomcat 7.0.42 • apache tomcat 7.0.43 • apache tomcat 7.0.44 … and 8 more

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References