Vulnerability in Apache Commons Fileupload
CVE-2013-0248
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.008 (55.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.008 · change: +0.001
Affected products
- Apache Commons Fileupload — versions 1.0, 1.1, 1.1.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/58326 (vdb-entry)
- marc.info/ (vendor-advisory)
- archives.neohapsis.com/archives/bugtraq/2013-03/0035.html (mailing-list)
- www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- www.osvdb.org/90906 (vdb-entry)
- security.gentoo.org/glsa/202107-39 (vendor-advisory)
Frequently asked questions
- What is CVE-2013-0248?
- CVE-2013-0248 is a medium-severity vulnerability in Apache Commons Fileupload, classified under CWE-264. CVSS score: 6.8/10. Published 2013-03-15.
- How severe is CVE-2013-0248?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2013-0248 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.