CVE-2023-36814 - CVE House
Back to Database
Status published High CVE-2023-36814

zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Vulnerability Description

Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-36814

Credits & Attribution

No credits recorded in the NVD database.

References

More from zopefoundation

View All →
CVE-2025-22153
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
High 7.9
CVE-2024-51734
User data deletion by anoynmous users in Zope
High 8.7
CVE-2024-47532
RestrictedPython information leakage via `AttributeError.obj` and the `string` module
High 8.7
CVE-2024-24811
Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
Critical 9.8
CVE-2023-44389
Zope management interface vulnerable to stored cross site scripting via the title property
Low 3.1

Affected Vendor

zopefoundation

View all reports →

Affected Software

Products.CMFCore
Vulnerable Versions:
< 3.2

Timeline

Official Publish: July 3rd, 2023
Last Modified: November 22nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery