CVE-2023-42457 - OpenCVE

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Plone	Rest

Configuration 1 [-]

OR	cpe:2.3:a:plone:rest:2.0.0:::::::*
	cpe:2.3:a:plone:rest:3.0.0:::::::*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2023/09/22/2
https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-09-21T14:49:32.123Z

Updated: 2024-08-02T19:23:38.908Z

Reserved: 2023-09-08T20:57:45.574Z

Link: CVE-2023-42457

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-09-21T15:15:10.943

Modified: 2023-09-25T18:53:11.763

Link: CVE-2023-42457

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42457", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-08T20:57:45.574Z", "datePublished": "2023-09-21T14:49:32.123Z", "dateUpdated": "2024-08-02T19:23:38.908Z"}, "containers": {"cna": {"title": "plone.rest vulnerable to Denial of Service when ++api++ is used many times", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq"}, {"name": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7"}, {"name": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302", "tags": ["x_refsource_MISC"], "url": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/22/2"}], "affected": [{"vendor": "plone", "product": "plone.rest", "versions": [{"version": ">= 2.0.0a1, < 2.0.1", "status": "affected"}, {"version": "= 3.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-21T14:49:32.123Z"}, "descriptions": [{"lang": "en", "value": "plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).\n"}], "source": {"advisory": "GHSA-h6rp-mprm-xgcq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:38.908Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq"}, {"name": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7"}, {"name": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/22/2", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:rest:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "5CD311A9-2185-4CC1-9FDB-8EB5F33DEB07", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:rest:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "73CAED86-5DE2-49CD-9AF0-5DB6C73670B3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).\n"}, {"lang": "es", "value": "plone.rest permite a los usuarios utilizar verbos HTTP como GET, POST, PUT, DELETE, etc. en Plone. A partir de la rama 2.x y antes de las versiones 2.0.1 y 3.0.1, cuando el recorridor `++api++` se usa accidentalmente varias veces en una URL, su manejo lleva cada vez m\u00e1s tiempo, lo que hace que el servidor responda menos. Los parches est\u00e1n disponibles en `plone.rest` 2.0.1 y 3.0.1. La serie 1.x no se ve afectada. Como workaround, se puede redirigir `/++api++/++api++` a `/++api++` en el servidor web frontend (nginx, Apache)."}], "id": "CVE-2023-42457", "lastModified": "2023-09-25T18:53:11.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-21T15:15:10.943", "references": [{"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/22/2"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}