CVE-2025-3734 - Vulnerability Details - OpenCVE

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00077.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Stage File Proxy Project	Stage File Proxy

Configuration 1 [-]

cpe:2.3:a:stage_file_proxy_project:stage_file_proxy:*:*:*:*:*:drupal:*:*

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-035

History

Tue, 02 Sep 2025 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Stage File Proxy Project Stage File Proxy Project stage File Proxy
CPEs		cpe:2.3:a:stage_file_proxy_project:stage_file_proxy::::::drupal::*
Vendors & Products		Stage File Proxy Project Stage File Proxy Project stage File Proxy

Wed, 16 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Apr 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.
Title		Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035
Weaknesses		CWE-770
References		https://www.drupal.org/sa-contrib-2025-035

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-04-16T16:31:19.029Z

Updated: 2025-04-16T17:15:48.584Z

Reserved: 2025-04-16T14:00:47.441Z

Link: CVE-2025-3734

Vulnrichment

Updated: 2025-04-16T17:15:39.205Z

NVD

Status : Analyzed

Published: 2025-04-16T17:15:49.937

Modified: 2025-09-02T18:38:19.813

Link: CVE-2025-3734

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3734", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-04-16T14:00:47.441Z", "datePublished": "2025-04-16T16:31:19.029Z", "dateUpdated": "2025-04-16T17:15:48.584Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/stage_file_proxy", "defaultStatus": "unaffected", "product": "Stage File Proxy", "repo": "https://git.drupalcode.org/project/stage_file_proxy", "vendor": "Drupal", "versions": [{"lessThan": "3.1.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Stephen Mustgrave (smustgrave)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-04-16T16:25:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.<p>This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5."}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-16T16:31:19.029Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-035"}], "source": {"discovery": "UNKNOWN"}, "title": "Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T17:15:44.963816Z", "id": "CVE-2025-3734", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:15:48.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3734", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T17:15:44.963816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:15:39.205Z"}}], "cna": {"title": "Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Stephen Mustgrave (smustgrave)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/stage_file_proxy", "vendor": "Drupal", "product": "Stage File Proxy", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.1.5", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/stage_file_proxy", "defaultStatus": "unaffected"}], "datePublic": "2025-04-16T16:25:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-035"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.<p>This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-16T16:31:19.029Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3734", "state": "PUBLISHED", "dateUpdated": "2025-04-16T17:15:48.584Z", "dateReserved": "2025-04-16T14:00:47.441Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-04-16T16:31:19.029Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}