{"id":"GHSA-7x9j-7223-rg5m","summary":"Improper Access Control in commons-fileupload","details":"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution","aliases":["CVE-2016-1000031"],"modified":"2024-03-14T05:33:10.334407Z","published":"2018-12-21T17:51:51Z","database_specific":{"cwe_ids":["CWE-284"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:23:40Z","nvd_published_at":"2016-10-25T14:29:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000031"},{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2016-30"},{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2016-23"},{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2016-12"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2020.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20190212-0001"},{"type":"WEB","url":"https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/WW-4812"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/FILEUPLOAD-279"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7x9j-7223-rg5m"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html"},{"type":"WEB","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"type":"WEB","url":"http://www.securityfocus.com/bid/93604"},{"type":"WEB","url":"http://www.zerodayinitiative.com/advisories/ZDI-16-570"}],"affected":[{"package":{"name":"commons-fileupload:commons-fileupload","ecosystem":"Maven","purl":"pkg:maven/commons-fileupload/commons-fileupload"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3"}]}],"versions":["1.0","1.0-beta-1","1.0-rc1","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3","1.3.1","1.3.1-jenkins-1","1.3.1-jenkins-2","1.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/12/GHSA-7x9j-7223-rg5m/GHSA-7x9j-7223-rg5m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}