Vulnerability · Published Apr 22, 2025 · Assigned by GitHub_M
CVE-2025-32959CUBA Vulnerable to Denial of Service (DoS) in the File Storage
Medium 6.5
In plain English
A medium-severity resource allocation without limits in cuba from cuba-platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.haulmont.cuba:cuba-core | 7.2.23 | GHSA-w3mp-6vrj-875g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cuba-platform | cuba | < 7.2.23 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g x_refsource_CONFIRM
- https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m x_refsource_MISC
- https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1 x_refsource_MISC
- https://docs.jmix.io/jmix/files-vulnerabilities.html x_refsource_MISC
- https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application x_refsource_MISC