CVE-2023-42457

High

Description

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

SeverityHigh

CVSS7.5

Exploit probability—

Product

Plone Rest

PublishedSep 21, 2023

First seenSep 21, 2023

Weakness typeCWE-400Uncontrolled resource consumption CWE-770Allocation of resources without limits

How to fix

Update

plone-rest2.0.1, 3.0.1 or later

Affected products

Product	Affected versions	Fixed in
plone rest	2.0.0, 3.0.0	—
plone-restPyPI	2.0.0a1 ≤ v < 2.0.1, 3.0.0 ≤ v < 3.0.1, No range specified	2.0.1, 3.0.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.