7.5

CVE-2023-42457

plone.rest vulnerable to Denial of Service when ++api++ is used many times

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Plone ≫ Rest Version2.0.0
Plone ≫ Rest Version3.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.82% 0.525
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

http://www.openwall.com/lists/oss-security/2023/09/22/2
Third Party Advisory
Mailing List
https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
Patch
https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
Patch
https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
Vendor Advisory