CVE-2013-2186 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2013-2186 - High Severity Vulnerability

Vulnerable Library - commons-fileupload-1.2.2.jar

The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

path: /root/.m2/repository/commons-fileupload/commons-fileupload/1.2.2/commons-fileupload-1.2.2.jar

Library home page: http://commons.apache.org/fileupload/

Dependency Hierarchy:

• struts2-core-2.3.31.jar (Root Library)
  • ❌ commons-fileupload-1.2.2.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Publish Date: 2013-10-28

URL: CVE-2013-2186

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://exchange.xforce.ibmcloud.com/vulnerabilities/88133

Fix Resolution: Apply the appropriate update for your system. See References.

---

Step up your Open Source Security Game with WhiteSource here