ByteOS Network

NVD Vulnerability Details :

CVE-2016-1000031

Deferred

More Info Official Page

Source-cve@mitre.org

Published At-25 Oct, 2016 | 14:29

Updated At-12 Apr, 2025 | 10:46

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

The Apache Software Foundation

>>commons_fileupload>>Versions up to 1.3.2(inclusive)

cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-284	Primary	nvd@nist.gov

Evaluator Description

Per Apache: "Having reviewed your report we have concluded that it does not represent a valid vulnerability in Apache Commons File Upload. If an application deserializes data from an untrusted source without filtering and/or validation that is an application vulnerability not a vulnerability in the library a potential attacker might leverage."

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html	cve@mitre.org	N/A
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	cve@mitre.org	N/A
http://www.securityfocus.com/bid/93604	cve@mitre.org	Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-570/	cve@mitre.org	Third Party Advisory VDB Entry
https://issues.apache.org/jira/browse/FILEUPLOAD-279	cve@mitre.org	Vendor Advisory
https://issues.apache.org/jira/browse/WW-4812	cve@mitre.org	N/A
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E	cve@mitre.org	N/A
https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E	cve@mitre.org	N/A
https://security.netapp.com/advisory/ntap-20190212-0001/	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpuapr2020.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpujan2020.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpujan2021.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpujul2020.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpujul2022.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpuoct2020.html	cve@mitre.org	N/A
https://www.oracle.com/security-alerts/cpuoct2021.html	cve@mitre.org	N/A
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	cve@mitre.org	N/A
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	cve@mitre.org	N/A
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	cve@mitre.org	N/A
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	cve@mitre.org	N/A
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	cve@mitre.org	N/A
https://www.tenable.com/security/research/tra-2016-12	cve@mitre.org	Third Party Advisory
https://www.tenable.com/security/research/tra-2016-23	cve@mitre.org	Third Party Advisory
https://www.tenable.com/security/research/tra-2016-30	cve@mitre.org	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/93604	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-570/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://issues.apache.org/jira/browse/FILEUPLOAD-279	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://issues.apache.org/jira/browse/WW-4812	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E	af854a3a-2127-422b-91ae-364da2661108	N/A
https://security.netapp.com/advisory/ntap-20190212-0001/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpuapr2020.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpujan2020.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpujan2021.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpujul2020.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpujul2022.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpuoct2020.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/security-alerts/cpuoct2021.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.tenable.com/security/research/tra-2016-12	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.tenable.com/security/research/tra-2016-23	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.tenable.com/security/research/tra-2016-30	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History