CVE-2013-4444

描述

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

如何修補 CVE-2013-4444

要修補 CVE-2013-4444,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 7.0.40 或更新版本

CVE-2013-4444 正在被利用嗎?

中等 — EPSS 為 14.0%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 7.0, < 7.0.40

參考連結(12)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-4444
• PATCHgithub.com/apache/tomcat
• WEBarchives.neohapsis.com/archives/bugtraq/2014-09/0075.html
• WEBmarc.info/?l=bugtraq&m=144498216801440&w=2
• WEB