Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-28837— Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Quick assessment

Affected
wagtail wagtail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Torchbox Wagtail是英国Torchbox公司的一套开源的内容管理系统（CMS）。 Wagtail 1.5到4.1.4、4.2、4.2.1版本存在跨站脚本漏洞，该漏洞源于Wagtail在处理上传的图片和文档时存在内存耗尽问题，从而导致拒绝服务崩溃。

CVSS 4.9 · Medium EPSS 1.07% · P65
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-28837

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
Source: CVE Program / CVE List V5
Vulnerability Description
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash of denial of service. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents. Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2). Site owners who are unable to upgrade to the new versions are encouraged to add extra protections outside of Wagtail to limit the size of uploaded files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Wagtail 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Torchbox Wagtail是英国Torchbox公司的一套开源的内容管理系统（CMS）。 Wagtail 1.5到4.1.4、4.2、4.2.1版本存在跨站脚本漏洞，该漏洞源于Wagtail在处理上传的图片和文档时存在内存耗尽问题，从而导致拒绝服务崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wagtail wagtail < 4.1.4 -

II. Public POCs for CVE-2023-28837

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-28837

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-28837 (4)

Vendor Advisories for CVE-2023-28837 (1)

Other References for CVE-2023-28837 (3)

IV. Related Vulnerabilities

Same product: wagtail
Same vendor: wagtail
Same weakness: CWE-400