CVE Feed

Dashboard / CVE / CVE-2016-1000031

CVE-2016-1000031

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

Published:Apr 20, 2016

Last Modified:Apr 12, 2025

EPS:Oct 25, 2016

EPSS Score:0.56432

CVSS Score:9.8

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Commons Fileupload

Apache

Commons Fileupload

Exploits

https://github.com/dawetmaster/CVE-2016-1000031-commons-fileupload-vulnerable

Common Weakness Enumeration

CWE-284 Improper Access Control

CWE-502 Deserialization of Untrusted Data

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-19 Embedding Scripts within Scripts

CAPEC-441 Malicious Logic Insertion

CAPEC-478 Modification of Windows Service Configuration

CAPEC-479 Malicious Root Certificate

CAPEC-502 Intent Spoof

CAPEC-503 WebView Exposure

CAPEC-536 Data Injected During Configuration

CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment

CAPEC-550 Install New Service

CAPEC-551 Modify Existing Service

CAPEC-552 Install Rootkit

CAPEC-556 Replace File Extension Handlers

CAPEC-558 Replace Trusted Executable

CAPEC-562 Modify Shared File

CAPEC-563 Add Malicious File to Shared Webroot

CAPEC-564 Run Software at Logon

CAPEC-578 Disable Security Software

CAPEC-586 Object Injection

Related CVEs

CVE-2025-48976 (CVSS 7.5) — Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache C…

CVE-2023-24998 (CVSS 7.5) — Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in t…

CVE-2016-3092 (CVSS 7.5) — The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.7…

CVE-2014-0050 (CVSS 7.5) — MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other…

CVE-2013-0248 (CVSS 3.3) — The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses…

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/93604

http://www.zerodayinitiative.com/advisories/ZDI-16-570/

https://issues.apache.org/jira/browse/FILEUPLOAD-279

https://issues.apache.org/jira/browse/WW-4812

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E

https://security.netapp.com/advisory/ntap-20190212-0001/

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.oracle.com/security-alerts/cpuoct2021.html

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://www.tenable.com/security/research/tra-2016-12

https://www.tenable.com/security/research/tra-2016-23

https://www.tenable.com/security/research/tra-2016-30

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/93604

http://www.zerodayinitiative.com/advisories/ZDI-16-570/

https://issues.apache.org/jira/browse/FILEUPLOAD-279

https://issues.apache.org/jira/browse/WW-4812

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E

https://security.netapp.com/advisory/ntap-20190212-0001/

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.oracle.com/security-alerts/cpuoct2021.html

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://www.tenable.com/security/research/tra-2016-12

https://www.tenable.com/security/research/tra-2016-23

https://www.tenable.com/security/research/tra-2016-30

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High