Vulnerability · Published Jul 3, 2023 · Assigned by GitHub_M
CVE-2023-36814zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
High 7.5
In plain English
A high-severity resource allocation without limits in Products.CMFCore from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | products-cmfcore | 3.2 | GHSA-4hpj-8rhv-9x87 |
| PyPI | products-cmfcore | 2.7.1 | GHSA-4hpj-8rhv-9x87 |
| PyPI | products-cmfcore | 3.2 | PYSEC-2023-113 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zopefoundation | Products.CMFCore | < 3.2 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H