CVE-2022-35221 TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2

Medium 5.4 Published 2 Aug 2022 Updated 16 Sep 2024

A remote attacker can cause server memory exhaustion and partial service disruption by posting thread subjects with excessively large content.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-35221?

CVE-2022-35221 is a medium-severity denial of service vulnerability in Teamplus Pro, published on 2 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.

Weakness: CWE-770

Which versions are affected by CVE-2022-35221?

It affects 1 product.

Products include Teamplus Team\+ Pro.

How do I fix CVE-2022-35221?

No fix has been published for CVE-2022-35221 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-35221 being exploited?

There is no known exploitation of CVE-2022-35221 in the wild and no public exploit code.

Sources

Also known as GHSA-qp55-wf2p-vrj5.