VulnerabilityModified
CVE-2023-3223
This may allow unauthorized users to cause remote Denial of Service (DoS) attack.
HIGH 7.5EPSS 2.68%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.68% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-789
- Affected
- redhat/undertow · redhat/openshift container platform · redhat/openshift container platform for ibm linuxone · redhat/openshift container platform for power · redhat/jboss enterprise application platform text-only advisories · redhat/single sign-on · redhat/jboss enterprise application platform
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2023:4505Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4506Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4507Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4509Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4918Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4919Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4920Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4921Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4924Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7247
- https://access.redhat.com/security/cve/CVE-2023-3223Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2209689Issue Tracking, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231027-0004/
- https://access.redhat.com/errata/RHSA-2023:4505Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4506Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4507Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4509Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4918Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4919Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4920Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4921Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:4924Vendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7247
- https://access.redhat.com/security/cve/CVE-2023-3223Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2209689Issue Tracking, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20231027-0004/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.