Medium severity · published Mar 15, 2013
CVE-2013-0248
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to…
6.8
CVSS
0.8%
EPSS
No
On KEV
Description
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Commons Fileupload · Apache
1.0; 1.1; 1.1.1; 1.2; 1.2.1; 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0248
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html
marc.info
http://marc.info/?l=bugtraq&m=144050155601375&w=2
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.osvdb.org
http://www.osvdb.org/90906
www.securityfocus.com
http://www.securityfocus.com/bid/58326
security.gentoo.org
https://security.gentoo.org/glsa/202107-39
More from Commons Fileupload
9.8
CVE-2016-1000031
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
7.5
CVE-2025-48976
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload
7.5
CVE-2023-24998
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
7.5
CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and…
7.5
CVE-2014-0050
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service…