GitHub Advisoryadvisory · Maven

GHSA-vm69-474v-7q2w Incorrect Default Permissions in Apache Commons FileUpload

LOW Published 2022-05-05 Modified 2022-07-08 Official page ↗
Aliases
CVE-2013-0248
Ecosystem
Maven
Packages
commons-fileupload:commons-fileupload
Severity
Low
Weaknesses
CWE-276
Reviewed
2022-07-08

Affected packages

• Maven commons-fileupload:commons-fileupload: >= 1.0, < 1.2.2 → fixed in 1.2.2

Description

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Related

Alias · CVE (1)

  • CVE-2013-0248 The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References