plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

The version of Plone installed on the remote host is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.7. It is, therefore, affected by the following vulnerabilities:

  - plone.namedfile has a stored cross-site scripting vulnerability for SVG images. (CVE-2023-41048)

  - When the ++api++ traverser in plone.rest is accidentally used multiple times in a url, handling it takes     increasingly longer, making the server less responsive (denial of service). (CVE-2023-42457)

  - Zope has a stored cross-site scripting vulnerability for SVG images; an attacker must first upload a     malicious SVG image and then trick a user into following a specially crafted link. (CVE-2023-42458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20230921) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The detected version of Plone python package, plone, is prior to version 5.2.14 or 6.x prior to 6.0.7. It is, therefore, affected by the following the vulnerabilities:

  - Multiple stored cross site scripting vulnerabilities exits when handling SVG images. An authenticated,     remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute     arbitrary script code in a user's browser session. (CVE-2023-41048, CVE-2023-42458)

  - A denial of service (DoS) vulnerability exists in plone.rest. An unauthenticated, remote attacker can     exploit this issue, to cause the server to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the
    2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used
    multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches
    are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may
    redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache). (CVE-2023-42457)

ID	Name	Product	Family	Type	Severity
329028	Plone 5.2.x < 5.2.14 / 6.0.x < 6.0.7 Multiple Vulnerabilities (HF 20230921)	Nessus	Misc.	Local	medium
300605	Plone Python Library Multiple Vulnerabilities (20230921)	Nessus	Misc.	Local	medium
415539	SCA: security update for plone.rest (GHSA-h6rp-mprm-xgcq)	Tenable Cloud Security	SCA Checks	Local	high
415539	SCA: security update for plone.rest (GHSA-h6rp-mprm-xgcq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2023-42457

high

Tenable Plugins

medium

medium

high

high