Authenticated users can trigger a denial of service condition in the Plone content management system by submitting excessively large data fields, rendering the system unresponsive.

This is an uncontrolled resource consumption flaw (CWE-400) where an authenticated user with content creation permissions can input maliciously crafted, oversized strings into specific fields, causing the application to consume excessive resources and become unresponsive.

Successful exploitation results in a denial of service, which prevents legitimate users from accessing or managing content within the Plone environment. Given the CVSS score of 6.5, this medium-severity vulnerability poses a significant risk to operational continuity, as it can be leveraged by any authenticated user to disrupt critical business workflows and potentially make affected content items impossible to edit or remove.

Immediate Action: Upgrade plone.app.dexterity to version 3.2.3, 4.1.3, or 5.0.1, and update plone.app.contenttypes to version 3.0.12, 4.0.10, or 5.0.1.

Proactive Monitoring: Monitor server logs for unusually large POST requests or spikes in memory consumption associated with content creation endpoints.

Compensating Controls: Implement input validation at the Web Application Firewall (WAF) level to restrict the character length of titles, descriptions, and file name fields until patches are applied.

Public Exploit Available: Unknown

Organizations utilizing the Plone CMS should prioritize applying the specified patches to the affected Dexterity and content-type packages. Because the vulnerability allows a low-privileged authenticated user to cause a system-wide denial of service, remediation is essential to maintain application availability and prevent potential service disruption.