Description
An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service.
Remediation
References
https://github.com/manolo/gwtupload/issues/33
https://logicaltrust.net/blog/2020/02/gwt-upload.html
Related Vulnerabilities
CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.12
CVE-2021-41164 Vulnerability in npm package ckeditor4
CVE-2023-38889 Vulnerability in maven package org.alluxio:alluxio-parent
CVE-2023-34467 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livetable-ui
CVE-2022-31160 Vulnerability in maven package org.webjars.bower:jquery-ui