what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Karl Dyszynski

Apache Commons FileUpload 1.2.2 Insecure /tmp Usage

Posted Mar 7, 2013

Authored by Hugo Vazquez Carames, Karl Dyszynski

Apache Commons FileUpload provides file upload capability for Servlets and web applications. During the upload process, FileUpload may (depending on configuration) save the uploaded file temporarily on disk. By default this will be in the system wide tmp directory. Because the temporary files have predictable file names and are stored in a publicly writeable location they are vulnerable to a TOCTOU attack. Versions 1.0 through 1.2.2 are affected.

tags | advisory, web, file upload

advisories | CVE-2013-0248

SHA-256 | aef9320b83ebe6ba6979332985d9a5aff8a232ccdbb3dd487e7f6d3b242f6f7a

Download | Favorite | View