Plone App Contenttypes
Monthly
Denial of service in Plone's Dexterity content system lets an authenticated user with content-creation rights submit items carrying excessively long titles, descriptions, or uploaded-file names, rendering the site unresponsive and leaving the resulting content hard to edit or delete. The flaw affects plone.app.dexterity through 3.2.2, 4.0.0-4.1.2 and 5.0.0, and plone.app.contenttypes through 3.0.11, 4.0.0-4.0.9 and 5.0.0, and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the AV:N vector still requires a valid low-privileged account. At the time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); the practical risk is highest on sites that permit open self-registration or grant content-editing permissions broadly to untrusted users, while the patched releases strictly cap field lengths.
Denial of service in Plone's Dexterity content system lets an authenticated user with content-creation rights submit items carrying excessively long titles, descriptions, or uploaded-file names, rendering the site unresponsive and leaving the resulting content hard to edit or delete. The flaw affects plone.app.dexterity through 3.2.2, 4.0.0-4.1.2 and 5.0.0, and plone.app.contenttypes through 3.0.11, 4.0.0-4.0.9 and 5.0.0, and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the AV:N vector still requires a valid low-privileged account. At the time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); the practical risk is highest on sites that permit open self-registration or grant content-editing permissions broadly to untrusted users, while the patched releases strictly cap field lengths.