CVE-2016-1000031 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2016-1000031 - High Severity Vulnerability

Vulnerable Library - commons-fileupload-1.3.jar

path: 2/repository/commons-fileupload/commons-fileupload/1.3/commons-fileupload-1.3.jar

Library home page: http://commons.apache.org/proper/commons-fileupload/

Dependency Hierarchy:

• ❌ commons-fileupload-1.3.jar (Vulnerable Library)

Found in commit: f396e60bf74726f66a202d308a1f2865177e4bee

Vulnerability Details

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

Publish Date: 2016-10-25

URL: CVE-2016-1000031

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: apache/commons-fileupload@388e824#diff-d9058813e9715d9a19a8dffdd07e5d01

Release Date: 2016-11-23

Fix Resolution: Replace or update the following files: .gitignore, DiskFileItemSerializeTest.java, changes.xml, DiskFileItem.java, release-notes.vm, faq.fml

---

Step up your Open Source Security Game with WhiteSource here