Lucene search

GitHub Advisory DatabaseGHSA-3QJ8-93XH-PWH2

HistoryApr 21, 2023 - 6:30 p.m.

Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files

2023-04-2118:30:24

CWE-400

GitHub Advisory Database

github.com

starlette

vulnerability

multipartparser

python

framework

denial of service

http

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

65.3%

JSON

There MultipartParser usage in Encode’s Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

Affected configurations

Vulners

Node

encodestarletteRange<0.25.0

CPENameOperatorVersion
starlettelt0.25.0

CPE	Name	Operator	Version
	starlette	lt	0.25.0

References

github.com/advisories/GHSA-3qj8-93xh-pwh2

github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa

github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x

nvd.nist.gov/vuln/detail/CVE-2023-30798

vulncheck.com/advisories/starlette-multipartparser-dos

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

65.3%

JSON

Related for GHSA-3QJ8-93XH-PWH2