CVE-2025-61668highCWE-476 CWE-754

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%

probabilidade de exploração

0.4%top 63% das CVEs

exploração observada

nãonenhuma fonte reporta

Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Produtos afetados

plone · volto

Referências

http://github.com/plone/volto/releases/tag/18.27.2 https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c https://github.com/plone/volto/pull/7412 https://github.com/plone/volto/pull/7413 https://github.com/plone/volto/releases/tag/16.34.1 https://github.com/plone/volto/releases/tag/17.22.2 https://github.com/plone/volto/releases/tag/19.0.0-alpha.6 https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33