CVE-2023-3223

2023-09-2715:18:56

Google

osv.dev

undertow

multipartconfig

outofmemoryerror

filesizethreshold

dos

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

Low

0.021 Low

EPSS

Percentile

89.3%

JSON

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it’s possible to bypass the limit by setting the file name in the request to null.

CPENameOperatorVersion
undertoweq2.2.8.Final
undertoweq1.3.0.Beta5
undertoweq2.0.0.Beta1
undertoweq1.1.0.Beta3
undertoweq2.0.27.Final
undertoweq2.2.19.Final
undertoweq2.0.29.Final
undertoweq2.0.20.Final
undertoweq1.0.0.Beta5
undertoweq1.0.0.Alpha9

Name	Operator	Version
undertow	eq	2.2.8.Final
undertow	eq	1.3.0.Beta5
undertow	eq	2.0.0.Beta1
undertow	eq	1.1.0.Beta3
undertow	eq	2.0.27.Final
undertow	eq	2.2.19.Final
undertow	eq	2.0.29.Final
undertow	eq	2.0.20.Final
undertow	eq	1.0.0.Beta5
undertow	eq	1.0.0.Alpha9