PT-2024-22614 · Unknown · Django-Wiki

Stsewd · Published 2024-03-18 · Updated 2024-03-19 · CVE-2024-28865

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions django-wiki versions prior to 0.10.1

Description The issue allows maliciously crafted article content to cause severe use of server CPU through a regular expression loop. This can be exploited by anonymous users creating or editing articles. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 0.10.1, update to version 0.10.1 to resolve the issue. As a temporary workaround, consider closing off access to create and edit articles by anonymous users.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-28865

GHSA-WJ85-W4F4-XH8H

Affected Products

Django-Wiki

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28865.json · Exploit
• https://github.com/django-wiki/django-wiki/commit/8e280fd6c0bd27ce847c67b2d216c6cbf920f88c · Patch
• https://github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wj85-w4f4-xh8h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28865 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28865 · Vendor Advisory
• https://github.com/django-wiki/django-wiki · Note
• https://twitter.com/CVEnew/status/1769849917193822431 · Twitter Post