CVE Feed

    Dashboard / CVE / CVE-2014-0050

    CVE-2014-0050

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

    Published:Feb 6, 2014
    Last Modified:Apr 12, 2025
    EPS:Mar 28, 2014
    EPSS Score:0.92877
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Commons Fileupload
    Vendor
    Apache
    Product
    Tomcat
    Vendor
    Oracle
    Product
    Retail Applications
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Fuse Esb Enterprise
    Vendor
    Redhat
    Product
    Fuse Management Console
    Vendor
    Redhat
    Product
    Fuse Mq Enterprise
    Vendor
    Redhat
    Product
    Jboss Amq
    Vendor
    Redhat
    Product
    Jboss Bpms
    Vendor
    Redhat
    Product
    Jboss Brms
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Portal Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Web Server
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Fuse Service Works
    Vendor
    Redhat
    Product
    Jboss Operations Network

    Exploits

    http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlhttp://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlhttps://www.exploit-db.com/exploits/31615https://github.com/dawetmaster/CVE-2014-0050-commons-fileupload-vulnerablehttps://github.com/jrrdev/cve-2014-0050

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://advisories.mageia.org/MGASA-2014-0110.html
    http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
    http://jvn.jp/en/jp/JVN14876762/index.html
    http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
    http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
    http://marc.info/?l=bugtraq&m=143136844732487&w=2
    http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
    http://rhn.redhat.com/errata/RHSA-2014-0252.html
    http://rhn.redhat.com/errata/RHSA-2014-0253.html
    http://rhn.redhat.com/errata/RHSA-2014-0400.html
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/57915
    http://secunia.com/advisories/58075
    http://secunia.com/advisories/58976
    http://secunia.com/advisories/59039
    http://secunia.com/advisories/59041
    http://secunia.com/advisories/59183
    http://secunia.com/advisories/59184
    http://secunia.com/advisories/59185
    http://secunia.com/advisories/59187
    http://secunia.com/advisories/59232
    http://secunia.com/advisories/59399
    http://secunia.com/advisories/59492
    http://secunia.com/advisories/59500
    http://secunia.com/advisories/59725
    http://secunia.com/advisories/60475
    http://secunia.com/advisories/60753
    http://svn.apache.org/r1565143
    http://tomcat.apache.org/security-7.html
    http://tomcat.apache.org/security-8.html
    http://www-01.ibm.com/support/docview.wss?uid=swg21669554
    http://www-01.ibm.com/support/docview.wss?uid=swg21675432
    http://www-01.ibm.com/support/docview.wss?uid=swg21676091
    http://www-01.ibm.com/support/docview.wss?uid=swg21676092
    http://www-01.ibm.com/support/docview.wss?uid=swg21676401
    http://www-01.ibm.com/support/docview.wss?uid=swg21676403
    http://www-01.ibm.com/support/docview.wss?uid=swg21676405
    http://www-01.ibm.com/support/docview.wss?uid=swg21676410
    http://www-01.ibm.com/support/docview.wss?uid=swg21676656
    http://www-01.ibm.com/support/docview.wss?uid=swg21676853
    http://www-01.ibm.com/support/docview.wss?uid=swg21677691
    http://www-01.ibm.com/support/docview.wss?uid=swg21677724
    http://www-01.ibm.com/support/docview.wss?uid=swg21681214
    http://www.debian.org/security/2014/dsa-2856
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
    http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
    http://www.securityfocus.com/archive/1/532549/100/0/threaded
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/65400
    http://www.ubuntu.com/usn/USN-2130-1
    http://www.vmware.com/security/advisories/VMSA-2014-0007.html
    http://www.vmware.com/security/advisories/VMSA-2014-0008.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1062337
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
    https://security.gentoo.org/glsa/202107-39
    http://advisories.mageia.org/MGASA-2014-0110.html
    http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
    http://jvn.jp/en/jp/JVN14876762/index.html
    http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
    http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
    http://marc.info/?l=bugtraq&m=143136844732487&w=2
    http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
    http://rhn.redhat.com/errata/RHSA-2014-0252.html
    http://rhn.redhat.com/errata/RHSA-2014-0253.html
    http://rhn.redhat.com/errata/RHSA-2014-0400.html
    http://seclists.org/fulldisclosure/2014/Dec/23
    http://secunia.com/advisories/57915
    http://secunia.com/advisories/58075
    http://secunia.com/advisories/58976
    http://secunia.com/advisories/59039
    http://secunia.com/advisories/59041
    http://secunia.com/advisories/59183
    http://secunia.com/advisories/59184
    http://secunia.com/advisories/59185
    http://secunia.com/advisories/59187
    http://secunia.com/advisories/59232
    http://secunia.com/advisories/59399
    http://secunia.com/advisories/59492
    http://secunia.com/advisories/59500
    http://secunia.com/advisories/59725
    http://secunia.com/advisories/60475
    http://secunia.com/advisories/60753
    http://svn.apache.org/r1565143
    http://tomcat.apache.org/security-7.html
    http://tomcat.apache.org/security-8.html
    http://www-01.ibm.com/support/docview.wss?uid=swg21669554
    http://www-01.ibm.com/support/docview.wss?uid=swg21675432
    http://www-01.ibm.com/support/docview.wss?uid=swg21676091
    http://www-01.ibm.com/support/docview.wss?uid=swg21676092
    http://www-01.ibm.com/support/docview.wss?uid=swg21676401
    http://www-01.ibm.com/support/docview.wss?uid=swg21676403
    http://www-01.ibm.com/support/docview.wss?uid=swg21676405
    http://www-01.ibm.com/support/docview.wss?uid=swg21676410
    http://www-01.ibm.com/support/docview.wss?uid=swg21676656
    http://www-01.ibm.com/support/docview.wss?uid=swg21676853
    http://www-01.ibm.com/support/docview.wss?uid=swg21677691
    http://www-01.ibm.com/support/docview.wss?uid=swg21677724
    http://www-01.ibm.com/support/docview.wss?uid=swg21681214
    http://www.debian.org/security/2014/dsa-2856
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
    http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
    http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
    http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
    http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
    http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
    http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
    http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
    http://www.securityfocus.com/archive/1/532549/100/0/threaded
    http://www.securityfocus.com/archive/1/534161/100/0/threaded
    http://www.securityfocus.com/bid/65400
    http://www.ubuntu.com/usn/USN-2130-1
    http://www.vmware.com/security/advisories/VMSA-2014-0007.html
    http://www.vmware.com/security/advisories/VMSA-2014-0008.html
    http://www.vmware.com/security/advisories/VMSA-2014-0012.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1062337
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
    https://security.gentoo.org/glsa/202107-39

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High