CVE-2023-36814
zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
- Record
CVE-2023-36814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2023-0209
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
- Record
EUVD-2023-0209- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4hpj-8rhv-9x87
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Impact
The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable.
Patches
The code has been fixed in Products.CMFCore version 3.2.
Workarounds
Users can make the affected decodeFolderFilter method unreachable by editing the PortalFolder.py module in Products.CMFCore by hand and then restarting Zope. Go to line 233 of PortalFolder.py and remove both the @security.public decorator for decodeFolderFilter as well as the method's entire docstring. This is safe because the method is not actually used by current code.
References
- Products.CMFCore security advisory GHSA-4hpj-8rhv-9x87
Credits
Thanks go to Nicolas VERDIER from onepoint.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Products.CMFCore issue tracker
- Email us at [email protected]
- Record
GHSA-4hpj-8rhv-9x87- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
- Record
CVE-2023-36814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
- Record
CVE-2023-36814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-4hpj-8rhv-9x87
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Impact
The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable.
Patches
The code has been fixed in Products.CMFCore version 3.2.
Workarounds
Users can make the affected decodeFolderFilter method unreachable by editing the PortalFolder.py module in Products.CMFCore by hand and then restarting Zope. Go to line 233 of PortalFolder.py and remove both the @security.public decorator for decodeFolderFilter as well as the method's entire docstring. This is safe because the method is not actually used by current code.
References
- Products.CMFCore security advisory GHSA-4hpj-8rhv-9x87
Credits
Thanks go to Nicolas VERDIER from onepoint.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Products.CMFCore issue tracker
- Email us at [email protected]
- Record
GHSA-4hpj-8rhv-9x87- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVPYSEC-2023-113 No score
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
- Record
PYSEC-2023-113- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
products-cmfcorePyPI |
3.0 up to 3.2 | 3.2 |
products-cmfcorePyPI |
before 2.7.1 | 2.7.1 |
products-cmfcorePyPI |
3.0 up to 3.2, plus listed versions 3.1 |
3.2 |
products-cmfcorePyPI |
before 2.7.1, plus listed versions 2.1.12.1.22.1.2-beta2.1.32.2.0 Show 43 moreShow less2.2.0-alpha2.2.0-beta2.2.12.2.102.2.112.2.122.2.132.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0-beta2.3.0-beta22.3.12.4.02.4.0b12.4.0b22.4.0b32.4.0b42.4.0b52.4.0b62.4.0b72.4.0b82.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.5.02.5.12.5.22.5.32.5.42.6.02.7.0 |
2.7.1 |
products-cmfcorePyPI |
before 3.2, plus listed versions 2.1.12.1.22.1.2-beta2.1.32.2.0 Show 45 moreShow less2.2.0-alpha2.2.0-beta2.2.12.2.102.2.112.2.122.2.132.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0-beta2.3.0-beta22.3.12.4.02.4.0b12.4.0b22.4.0b32.4.0b42.4.0b52.4.0b62.4.0b72.4.0b82.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.5.02.5.12.5.22.5.32.5.42.6.02.7.03.03.1 |
3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36814 is a high vulnerability (CVSS 7.5) in Zope Products.cmfcore, published July 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in products-cmfcore 3.2.
References
github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
nvd.nist.gov/vuln/detail/CVE-2023-36814
Left out here: 1 version. The JSON record has them.