plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.3, 3.2.3, 4.0.10, 3.0.12, 5.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- plone plone.app.dexterity
From 4.0.0 · fixed in 4.1.3; fixed in 3.2.3
- plone plone.app.contenttypes
From 4.0.0 · fixed in 4.0.10; fixed in 3.0.12
- plone-app-dexterityPyPI
From 5.0.0 · fixed in 5.0.1
- plone-app-dexterityPyPI
From 4.0.0 · fixed in 4.1.3
- plone-app-dexterityPyPI
fixed in 3.2.3
- plone-app-dexterityPyPI
fixed in 3.2.3; From 4.0.0 · fixed in 4.1.3; From 5.0.0 · fixed in 5.0.1