How severe is CVE-2023-45290?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.5 out of 10.

What type of vulnerability is CVE-2023-45290?

This is classified as CWE-770, which is a common weakness in software security.

CVE-2023-45290 - MEDIUM Severity | CVSS 6.5

Vulnerability Description

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Related Vulnerabilities

CVE-2017-11525

MEDIUM

CVSS:6.5(Medium)

The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.

CWE-7702017

CVE-2017-12432

MEDIUM

CVSS:6.5(Medium)

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.

CWE-7702017

CVE-2017-12563

MEDIUM

CVSS:6.5(Medium)

In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service.

CWE-7702017

CVE-2017-12643

MEDIUM

CVSS:6.5(Medium)

ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.

CWE-7702017

CVE-2017-12691

MEDIUM

CVSS:6.5(Medium)

The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.

CWE-7702017

CVE-2017-12692

MEDIUM

CVSS:6.5(Medium)

The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.

CWE-7702017