En bref
- CVE-2023-42457 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant plone-rest, rest (plone).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.3% des vulnérabilités.
- Correctif : mettre à jour vers 2.0.1, 3.0.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| plone-rest PyPI | ≥ 2.0.0a1, < 2.0.1≥ 3.0.0, < 3.0.1all versions
| 2.0.13.0.1
|
| rest | = 2.0.0= 3.0.0
| No fix yet |
Description
Impact
When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.
Patches
Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected.
Workarounds
In your frontend web server (nginx, Apache) you can redirect /++api++/++api++ to /++api++.
NVD description
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free