CVE-2025-58047highCWE-755

CVE-2025-58047: falha de alta gravidade em plone volto

Volto affected by possible DoS by invoking specific URL by anonymous user

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar volto+ Monitorar @plone/volto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.7%
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
plone · volto
CVEs relacionadas — plone volto

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24740MEDIUMImproper Authentication in VoltoEPSS 0.6%CVE-2025-61668HIGH@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous userEPSS 0.4%