CVE-2023-36260: Craft CMS Feed-Me Denial of Service Vulnerability
Summary
CVE-2023-36260: Craft CMS Feed-Me. Affects craftcms/cms versions < 4.6.2. Fixed in 4.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Craft CMS is a popular content management system that allows users to create and manage websites. It provides a range of features and functionalities, including the ability to import feeds using the Feed-Me plugin. The Feed-Me plugin allows users to import data from various sources, such as RSS feeds, into their Craft CMS websites. However, a vulnerability has been discovered in Craft CMS version 4.6.1.1 that could lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in Craft CMS version 4.6.1.1 is due to a flaw in the handling of the Feed-Me Name and Feed-Me URL fields. An attacker can exploit this vulnerability by saving a feed using an Asset element type with no volume selected. This can cause the system to become unresponsive, resulting in a denial of service condition. The impact of this vulnerability can range from inconvenience to potential disruption of website functionality.
How To Fix
Minimum fixed version
4.6.2
This is the first release that contains the fix.
composer require craftcms/cms:4.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Feed-Me Name and Feed-Me URL fields or ensure that a volume is selected when saving a feed. This can help mitigate the risk of a denial of service attack. However, it is strongly advised to apply the official fix by upgrading to the latest version of Craft CMS as soon as possible.
Conclusion
In conclusion, Craft CMS version 4.6.1.1 is vulnerable to a denial of service attack when using the Feed-Me plugin. It is crucial for users to upgrade to the latest version of Craft CMS to mitigate the risk of this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system that allows users to create and manage websites.
The Feed-Me plugin is a plugin for Craft CMS that allows users to import data from various sources, such as RSS feeds.
A denial of service attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming the target system with a flood of incoming requests.
The impact of this vulnerability can range from inconvenience to potential disruption of website functionality.
To fix this vulnerability, it is recommended to upgrade to Craft CMS version 4.6.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
