The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libcommons-fileupload-java | Jul 30, 2024 | Oct 28, 2013 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to the latest versionUpgrade Jenkins to version 1.583 | Nov 13, 2017 | Oct 28, 2013 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 19637463 for version 10.3.6.0.0.Apply the Patch Set Update (PSU) 19637459 for version 12.1.1.0.0.Apply the Patch Set Update (PSU) 19637454 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 19716486 for version 12.1.2.0.0. | Apr 3, 2018 | Oct 28, 2013 |
| Redhat Openshift | — | Upgrade atomic-openshift | Jun 18, 2018 | Oct 15, 2013 |
| Suse | — | Upgrade jakarta-commons-fileuploadUpgrade jakarta-commons-fileupload-javadoc | Feb 17, 2015 | Oct 28, 2013 |
| Ubuntu | — | Upgrade libcommons-fileupload-java | Nov 8, 2024 | Oct 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub