CVE-2023-42457

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/09/22/2	Mailing List Third Party Advisory
https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7	Patch
https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302	Patch
https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:plone:rest:2.0.0:::::::*
	cpe:2.3:a:plone:rest:3.0.0:::::::*

History

No history.

Information

Published : 2023-09-21 15:15

Updated : 2023-09-25 18:53

NVD link : CVE-2023-42457

Mitre link : CVE-2023-42457

CVE.ORG link : CVE-2023-42457

JSON object : View

Products Affected

plone

rest

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-42457", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-09-21T15:15:10.943", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/09/22/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).\n"}, {"lang": "es", "value": "plone.rest permite a los usuarios utilizar verbos HTTP como GET, POST, PUT, DELETE, etc. en Plone. A partir de la rama 2.x y antes de las versiones 2.0.1 y 3.0.1, cuando el recorridor `++api++` se usa accidentalmente varias veces en una URL, su manejo lleva cada vez m\u00e1s tiempo, lo que hace que el servidor responda menos. Los parches est\u00e1n disponibles en `plone.rest` 2.0.1 y 3.0.1. La serie 1.x no se ve afectada. Como workaround, se puede redirigir `/++api++/++api++` a `/++api++` en el servidor web frontend (nginx, Apache)."}], "lastModified": "2023-09-25T18:53:11.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plone:rest:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CD311A9-2185-4CC1-9FDB-8EB5F33DEB07"}, {"criteria": "cpe:2.3:a:plone:rest:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73CAED86-5DE2-49CD-9AF0-5DB6C73670B3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}