CVE-2023-36814: zope products.cmfcore

csirt@kutim:~/threat-intel/cve/CVE-2023-36814

CVSS 7.5 · High EPSS 0,72%

Kerentanan Allocation of Resources Without Limits or Throttling pada zope products.cmfcore. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.

Rincian

Terbit di NVD: 3 Juli 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,72% peluang dieksploitasi; lebih tinggi dari 52,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zope	products.cmfcore	Semua versi sebelum 3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5 mitigasi · patch · advisory vendor
https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.