Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-3223

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Published

2023-09-27T15:18:56.457

Last Modified

2024-11-21T08:16:44.037

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-789
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat undertow < 2.2.24 Yes
Application redhat openshift_container_platform 4.11 Yes
Application redhat openshift_container_platform 4.12 Yes
Application redhat openshift_container_platform_for_ibm_linuxone 4.9 Yes
Application redhat openshift_container_platform_for_ibm_linuxone 4.10 Yes
Application redhat openshift_container_platform_for_power 4.9 Yes
Application redhat openshift_container_platform_for_power 4.10 Yes
Operating System redhat enterprise_linux 8.0 No
Application redhat jboss_enterprise_application_platform_text-only_advisories - Yes
Application redhat single_sign-on - Yes
Application redhat single_sign-on 7.6 Yes
Operating System redhat enterprise_linux 7.0 No
Operating System redhat enterprise_linux 8.0 No
Operating System redhat enterprise_linux 9.0 No
Application redhat jboss_enterprise_application_platform 7.4 Yes
Operating System redhat enterprise_linux 7.0 No
Operating System redhat enterprise_linux 8.0 No
Operating System redhat enterprise_linux 9.0 No
References