CVE-2016-1000031 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2016-1000031 - High Severity Vulnerability

Vulnerable Library - commons-fileupload-1.2.2.jar

The FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

path: /root/.m2/repository/commons-fileupload/commons-fileupload/1.2.2/commons-fileupload-1.2.2.jar

Library home page: http://commons.apache.org/fileupload/

Dependency Hierarchy:

• struts2-core-2.3.31.jar (Root Library)
  • ❌ commons-fileupload-1.2.2.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

Publish Date: 2016-10-25

URL: CVE-2016-1000031

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: apache/commons-fileupload@388e824#diff-d9058813e9715d9a19a8dffdd07e5d01

Release Date: 2016-11-23

Fix Resolution: Replace or update the following files: .gitignore, DiskFileItemSerializeTest.java, changes.xml, DiskFileItem.java, release-notes.vm, faq.fml

---

Step up your Open Source Security Game with WhiteSource here