CVE-2025-3734 - Vulnerability Details - OpenCVE

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-035

History

Wed, 16 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Apr 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.
Title		Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035
Weaknesses		CWE-770
References		https://www.drupal.org/sa-contrib-2025-035

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-04-16T16:31:19.029Z

Updated: 2025-04-16T17:15:48.584Z

Reserved: 2025-04-16T14:00:47.441Z

Link: CVE-2025-3734

Vulnrichment

Updated: 2025-04-16T17:15:39.205Z

NVD

Status : Awaiting Analysis

Published: 2025-04-16T17:15:49.937

Modified: 2025-04-17T20:22:16.240

Link: CVE-2025-3734

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3734", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-04-16T14:00:47.441Z", "datePublished": "2025-04-16T16:31:19.029Z", "dateUpdated": "2025-04-16T17:15:48.584Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/stage_file_proxy", "defaultStatus": "unaffected", "product": "Stage File Proxy", "repo": "https://git.drupalcode.org/project/stage_file_proxy", "vendor": "Drupal", "versions": [{"lessThan": "3.1.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Stephen Mustgrave (smustgrave)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-04-16T16:25:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.<p>This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5."}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-16T16:31:19.029Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-035"}], "source": {"discovery": "UNKNOWN"}, "title": "Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T17:15:44.963816Z", "id": "CVE-2025-3734", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:15:48.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3734", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T17:15:44.963816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:15:39.205Z"}}], "cna": {"title": "Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Stephen Mustgrave (smustgrave)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/stage_file_proxy", "vendor": "Drupal", "product": "Stage File Proxy", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.1.5", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/stage_file_proxy", "defaultStatus": "unaffected"}], "datePublic": "2025-04-16T16:25:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-035"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.<p>This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-16T16:31:19.029Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3734", "state": "PUBLISHED", "dateUpdated": "2025-04-16T17:15:48.584Z", "dateReserved": "2025-04-16T14:00:47.441Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-04-16T16:31:19.029Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}