IBM WebSphere Application Server: CVE-2023-24998: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

IBM WebSphere Application Server: CVE-2023-24998: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

02/20/2023

Created

05/12/2023

Added

05/12/2023

Modified

01/28/2025

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Solution(s)

• ibm-was-install-8-5-0-0-ph50863
• ibm-was-install-9-0-0-0-ph50863
• ibm-was-upgrade-8-5-0-0-8-5-5-24
• ibm-was-upgrade-8-5-23-0-0-4-liberty
• ibm-was-upgrade-9-0-0-0-9-0-5-16

References

• https://attackerkb.com/topics/cve-2023-24998
• CVE - 2023-24998