CVE-2023-42457

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

• CWE-400
• CWE-770
• CWE-770

• http://www.openwall.com/lists/oss-security/2023/09/22/2Mailing List, Third Party Advisory
• https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7Patch
• https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302Patch
• https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcqVendor Advisory
• http://www.openwall.com/lists/oss-security/2023/09/22/2Mailing List, Third Party Advisory
• https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7Patch
• https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302Patch
• https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcqVendor Advisory

Published

Sep 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42451Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42455Wazuh is a security detection, visibility, and compliance op…8.8
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1
• CVE-2023-42458Zope is an open-source web application server. Prior to vers…5.4
• CVE-2023-42459Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2023-4246The GiveWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2023-42460Vyper is a Pythonic Smart Contract Language for the EVM. The…7.5
• CVE-2023-42461GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.8
• CVE-2023-42462GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.1