CVE-2023-0299 : Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.

Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.

Published 2023-01-14 15:15:09

Updated 2023-01-23 14:22:20

Source huntr.dev

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2023-0299

Publify Project » Publify
Versions before (<) 9.2.10
cpe:2.3:a:publify_project:publify:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.4	HIGH	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	1.7	6.0	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: security@huntr.dev (Primary)

https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53

The publify application allows large characters to insert in the input field "title name and post field" on the article field which can allow attackers to cause a Denial of Service (DoS) vulnerability
Exploit;Patch;Third Party Advisory
https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1

Validate lengths of string attributes · publify/publify@ca46da2 · GitHub
Patch;Third Party Advisory

Jump to