esapi-2.4.0.0.jar: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-for-github-com[bot]]

Vulnerable Library - esapi-2.4.0.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Found in HEAD commit: 0535b00e652a49146dbe0273d6dfa6ec16b74c8f

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (esapi version)	Remediation Available
CVE-2023-24998	High	7.5	commons-fileupload-1.4.jar	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2023-24998

### Vulnerable Library - commons-fileupload-1.4.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar

Dependency Hierarchy: - esapi-2.4.0.0.jar (Root Library) - :x: **commons-fileupload-1.4.jar** (Vulnerable Library)

Found in HEAD commit: 0535b00e652a49146dbe0273d6dfa6ec16b74c8f

Found in base branch: master

### Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Publish Date: 2023-02-20

URL: CVE-2023-24998

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2023/q1/108

Release Date: 2023-02-20

Fix Resolution: commons-fileupload:commons-fileupload:1.5;org.apache.tomcat:tomcat-coyote:8.5.85,9.0.71,10.1.5

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.