CVE-2023-42457

CVSS V2 None CVSS V3 None
Description
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
Overview
  • CVE ID
  • CVE-2023-42457
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-09-21T14:49:32.123Z
  • Last Modified Date
  • 2023-09-21T14:49:32.123Z
Weakness Enumerations
CWE URL
CWE-400 http://cwe.mitre.org/data/definitions/400.html
CWE-770 http://cwe.mitre.org/data/definitions/770.html
References
Reference URL Reference Tags
https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq x_refsource_CONFIRM
https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7 x_refsource_MISC
https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302 x_refsource_MISC
http://www.openwall.com/lists/oss-security/2023/09/22/2
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-42457
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42457
History
Created Old Value New Value Data Type Notes
2024-06-25 13:43:28 Added to TrackCVE