CVE-2016-3092CWE-20

CVE-2016-3092

High · published July 5, 2016

CVSS v3.1
7.5
EPSS
37%
Percentile
98.5
In the wild
Unconfirmed
What it is

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.37171 · 98.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2016-07-05T02:59Z
Affected products (94)
ProductVersionsFixed in
hp/icewall_identity_managerall versions—
hp/icewall_sso_agent_optionall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
debian/debian_linuxall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/commons_fileupload≤ 1.3.1—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
References (98)
http://jvn.jp/en/jp/JVN89379547/index.html · [email protected]http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121 · [email protected]http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html · [email protected]http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2068.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2069.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2070.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2071.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2072.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2599.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2807.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2808.html · [email protected]http://rhn.redhat.com/errata/RHSA-2017-0457.html · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1743480 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1743722 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1743738 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1743742 · [email protected]http://tomcat.apache.org/security-7.html · [email protected]http://tomcat.apache.org/security-8.html · [email protected]http://tomcat.apache.org/security-9.html · [email protected]http://www.debian.org/security/2016/dsa-3609 · [email protected]http://www.debian.org/security/2016/dsa-3611 · [email protected]http://www.debian.org/security/2016/dsa-3614 · [email protected]http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · [email protected]http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · [email protected]http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · [email protected]http://www.securityfocus.com/bid/91453 · [email protected]http://www.securitytracker.com/id/1036427 · [email protected]http://www.securitytracker.com/id/1036900 · [email protected]http://www.securitytracker.com/id/1037029 · [email protected]http://www.securitytracker.com/id/1039606 · [email protected]http://www.ubuntu.com/usn/USN-3024-1 · [email protected]http://www.ubuntu.com/usn/USN-3027-1 · [email protected]https://access.redhat.com/errata/RHSA-2017:0455 · [email protected]https://access.redhat.com/errata/RHSA-2017:0456 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=1349468 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 · [email protected]https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://security.gentoo.org/glsa/201705-09 · [email protected]https://security.gentoo.org/glsa/202107-39 · [email protected]https://security.netapp.com/advisory/ntap-20190212-0001/ · [email protected]https://www.oracle.com/security-alerts/cpuapr2020.html · [email protected]https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · [email protected]http://jvn.jp/en/jp/JVN89379547/index.html · af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121 · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html · af854a3a-2127-422b-91ae-364da2661108http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2068.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2069.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2070.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2071.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2072.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2599.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2807.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2808.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2017-0457.html · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1743480 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1743722 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1743738 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1743742 · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-7.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-8.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-9.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3609 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3611 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3614 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/91453 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036427 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036900 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037029 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1039606 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-3024-1 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-3027-1 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0455 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0456 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1349468 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201705-09 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202107-39 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190212-0001/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 JUL 22:00Z
    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x…
    cvelistv5