Lucene search

K
freebsdFreeBSD2DEF7C4B-736F-4754-9F03-236FCB586D91
HistoryApr 03, 2023 - 12:00 a.m.

py-wagtail -- DoS vulnerability

2023-04-0300:00:00
vuxml.freebsd.org
6
wagtail
memory exhaustion
dos
admin users
large files
vulnerability

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

57.4%

A memory exhaustion bug exists in Wagtail’s handling of uploaded images and documents.
For both images and documents, files are loaded into memory during upload for additional processing.
A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
It can only be exploited by admin users with permission to upload images or documents.
Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code.

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

57.4%

Related for 2DEF7C4B-736F-4754-9F03-236FCB586D91