CyberRota Analysis
AI-GeneratedThe vulnerability affects the plone.app.portlets component in Java, allowing users to exploit RSS portlets by submitting excessively large feed URLs, which can lead to denial of service through excessive memory consumption. Additionally, the flawed URL handling permits server-side requests to internal services and can execute malicious JavaScript via crafted feed items, posing a significant security risk. Organizations using affected versions prior to 5.0.8, 6.0.4, and 7.0.2 should prioritize patching to mitigate potential service disruptions and security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.