Cyber Resilience

CVE-2023-3223

High

Published: 27 September 2023

Published
27 September 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0065 71.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-3223 is a high-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 28.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the…

more

file size, it's possible to bypass the limit by setting the file name in the request to null.

CWE(s)
CWE-789NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

redhat
undertow
≤ 2.2.24
redhat
openshift container platform
4.11, 4.12
redhat
openshift container platform for ibm linuxone
4.10, 4.9
redhat
openshift container platform for power
4.10, 4.9
redhat
jboss enterprise application platform text-only advisories
all versions
redhat
single sign-on
7.6, all versions
redhat
jboss enterprise application platform
7.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References