~ / search / GHSA-vm69-474v-7q2w

GHSA-vm69-474v-7q2w

Incorrect Default Permissions in Apache Commons FileUpload

Source: GitHub Advisory Database (reviewed) Low CVE-2013-0248

Packages

EcosystemPackageAffectedFixed in
Maven commons-fileupload:commons-fileupload >= 1.0, < 1.2.2 1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

References

External links from the advisory. They lead to third-party sites.