From 4b47c88212e8211bce01db8aec41c536c6f97f09 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 22 Apr 2025 16:57:58 +0000
Subject: [PATCH] Publish GHSA-f3gv-cwwh-758m

---
 .../GHSA-f3gv-cwwh-758m.json                  | 84 +++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-f3gv-cwwh-758m/GHSA-f3gv-cwwh-758m.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-f3gv-cwwh-758m/GHSA-f3gv-cwwh-758m.json b/advisories/github-reviewed/2025/04/GHSA-f3gv-cwwh-758m/GHSA-f3gv-cwwh-758m.json
new file mode 100644
index 00000000000..c2cf7ec879e
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-f3gv-cwwh-758m/GHSA-f3gv-cwwh-758m.json
@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f3gv-cwwh-758m",
+  "modified": "2025-04-22T16:55:42Z",
+  "published": "2025-04-22T16:55:41Z",
+  "aliases": [
+    "CVE-2025-32952"
+  ],
+  "summary": "io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage",
+  "details": "### Impact\n\nThe local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service.\n\nThe severity of the vulnerability is mitigated by the fact that the application UI and the generic REST API are typically accessible only to authenticated users. Additionally, the /files endpoint in Jmix requires specific permissions and is disabled by default. \n\n### Patches\n\nThe problem has been fixed in Jmix 1.6.2+ and 2.4.0+.\n\n### Workarounds\n\nA workaround for those who are unable to upgrade: [Disable Files Endpoint in Jmix Application](https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.jmix.localfs:jmix-localfs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.0.0"
+            },
+            {
+              "fixed": "1.6.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.jmix.localfs:jmix-localfs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.4.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jmix-framework/jmix"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-22T16:55:41Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file