LiveActive security incident?Get immediate response
CVE Record

CVE-2023-36814: zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw can let an unauthenticated remote user crash sites built on vulnerable Products.CMFCore, including Plone-based portals. The business impact is service outage, not data theft or tampering based on the supplied sources.

Executive priority

Treat as a high-priority availability issue for public portals. Patch promptly, especially where site downtime would affect customers, operations, or reputation.

Technical view

Products.CMFCore before 3.2 used Python's marshal module on unchecked input in a public PortalFolder method. That exposure can trigger unauthenticated denial of service and crashes across portal software built on Products.CMFCore.

Likely exposure

Deployments using zopefoundation Products.CMFCore versions before 3.2 are affected. The advisory states all deployments are vulnerable, including portal software built on it, such as Plone.

Exploitation context

The CVSS vector is network-accessible, low complexity, no privileges, and no user interaction. KEV status is false, and the supplied sources do not report active exploitation.

Researcher notes

Evidence supports unauthenticated crash/DoS, not confidentiality or integrity impact. The advisory names Products.CMFCore <3.2 and the fixing commit, but the bundle does not provide exploit prevalence or detailed runtime conditions.

Mitigation direction

  • Upgrade Products.CMFCore to version 3.2 or later.
  • Inventory Zope CMF and Plone deployments for Products.CMFCore usage.
  • Check vendor or distribution guidance for packaged update paths.
  • Prioritize internet-facing portals and business-critical content sites.

Validation and detection

  • Confirm installed Products.CMFCore versions are 3.2 or later.
  • Map public portal applications that depend on Products.CMFCore.
  • Review recent crash or availability incidents for affected portals.
  • Verify change records show the patched dependency deployed to production.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-36814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2023-36814Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
zopefoundationProducts.CMFCore< 3.2Listed
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs