Description

Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Remediation

References

CVE-2011-4462

Related Vulnerabilities

Drupal Inefficient Regular Expression Complexity Vulnerability (CVE-2022-24729)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-1552)

Oracle Database Server CVE-2014-6544 Vulnerability (CVE-2014-6544)

OpenSSL Cryptographic Issues Vulnerability (CVE-2013-6450)

WordPress Plugin Code Insert Manager (Q2W3 Inc Manager) ZeroClipboard Cross-Site Scripting (2.3.1)

Severity

Medium

Classification

CVE-2011-4462 CWE-20

Tags

Missing Update Known Vulnerabilities