plone.rest vulnerable to Denial of Service when ++api++ is used many times
CVE-2023-42457
7.5HIGH
What is CVE-2023-42457?
The plone.rest component allows for various HTTP verbs like GET, POST, PUT, and DELETE. However, in versions 2.x before 2.0.1 and 3.x before 3.0.1, an accidental redundancy in the URL structure involving the ++api++ traverser leads to significant performance degradation. This results in increased server response times, ultimately compromising the user experience. It is advisable for users to apply the available patches in versions 2.0.1 and 3.0.1. Additionally, for immediate mitigation, a redirection rule can be implemented on the frontend server to minimize impact.
Affected Version(s)
plone.rest >= 2.0.0a1, < 2.0.1 < 2.0.0a1, 2.0.1
plone.rest = 3.0.0 = 3.0.0