plone rest vulnerabilities

Latest plone rest CVEs

Newest publication first

1. CVE-2023-42457 plone.rest vulnerable to Denial of Service when ++api++ is used many times

   Published 2023-09-21

   High·CVSS 7.5 EPSS 1.0%

   plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the se...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.