{"id":"CVE-2023-42457","aliases":["EUVD-2023-0203","GHSA-h6rp-mprm-xgcq","PYSEC-2023-178"],"status":"published","title":"plone.rest vulnerable to Denial of Service when ++api++ is used many times","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01013,"percentile":0.63661,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-09-21T14:49:32Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"PyPI","package":"plone-rest","fixed_in":["2.0.1","3.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"plone-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a1"},{"fixed":"2.0.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"plone-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"},{"fixed":"3.0.1"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"plone-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a1"},{"fixed":"2.0.1"}]}],"versions":["2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.0a5","2.0.0a6.dev0"]},{"source":"osv","ecosystem":"PyPI","package":"plone-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"plone-rest","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"77846a9842889b24f35e8bedc2e9d461388d3302"},{"fixed":"43b4a7e86206e237e1de5ca3817ed071575882f7"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0a1","1.0a2","1.0a3","1.0a4","1.0a5","1.0a6","1.0a7","1.0b1","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.0a5","2.0.0a6.dev0","2.0.1","3.0.0","3.0.1","4.0.0","3.0.2","4.1.0","4.1.1","4.1.2","4.1.3","5.0.0","5.1.0"]}],"products":[{"vendor":"plone","product":"plone.rest"},{"vendor":"plone","product":"rest"}],"references":[{"url":"https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/22/2","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42457","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone-rest/PYSEC-2023-178.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h6rp-mprm-xgcq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42457.json","tags":["advisory"]},{"url":"https://github.com/plone/plone.rest","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-42457","title":"plone.rest vulnerable to Denial of Service when ++api++ is used many times","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).","status":"published","published":"2023-09-21T14:49:32.123Z","modified":"2025-02-13T17:09:22.325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-0203","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).","status":"published","published":"2023-09-21T14:49:32Z","modified":"2025-02-13T17:09:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:49.098775Z"}],"ghsa":[{"id":"GHSA-h6rp-mprm-xgcq","title":"plone.rest vulnerable to Denial of Service when ++api++ is used many times","description":"### Impact\nWhen the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.\n\n### Patches\nPatches will be released in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected.\n\n### Workarounds\nIn your frontend web server (nginx, Apache) you can redirect `/++api++/++api++` to `/++api++`.","status":"published","published":"2023-09-21T17:06:37Z","modified":"2024-10-09T21:24:10Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2023-42457","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).","status":"published","published":"2023-09-21T15:15:10.943Z","modified":"2026-06-17T06:23:52.353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-42457","title":"plone.rest vulnerable to Denial of Service when ++api++ is used many times","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).","status":"published","published":"2023-09-21T14:49:32.123Z","modified":"2026-10-28T02:31:09.403625193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-h6rp-mprm-xgcq","title":"plone.rest vulnerable to Denial of Service when ++api++ is used many times","description":"### Impact\nWhen the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.\n\n### Patches\nPatches will be released in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected.\n\n### Workarounds\nIn your frontend web server (nginx, Apache) you can redirect `/++api++/++api++` to `/++api++`.","status":"published","published":"2023-09-21T17:06:37Z","modified":"2025-02-13T19:36:59.155073Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"PYSEC-2023-178","description":"plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).\n","status":"published","published":"2023-09-21T15:15:00Z","modified":"2025-10-09T08:26:29.886157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.837392Z"}]}}