Description (CNA)
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wger-project / wger | affected 0 before 2.5; unaffected 2.5 |
CWE
CWE-400
References
- https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj
- https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence
ADP enrichment
No English description supplied.
No references supplied.