Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-PWGM-JVQV-6V8P
HistoryMay 17, 2022 - 5:37 a.m.

Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

2022-05-1705:37:14
GitHub Advisory Database
github.com
4
plone
cmfeditions
anonymous access

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.2

Confidence

Low

EPSS

0.967

Percentile

99.7%

JSON

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Affected configurations

Vulners
Node
ploneploneRange4.2a1–4.2a2
OR
ploneploneRange4.1–4.1.1
OR
ploneploneRange4.0–4.0.9
VendorProductVersionCPE
ploneplone*cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*

Related

cvelist 2
nvd 2
cve 2
prion 2
seebug 2
saint 4
packetstorm 2
dsquare 1
osv 1
nessus 1
exploitpack 1
metasploit 1
exploitdb 1
d2 1
checkpoint_advisories 1
zdt 1
github 1
canvas 1
cvelist
cvelist
CVE-2011-4030
2011-10-10 10:00:00
CVE-2011-3587
2011-10-10 10:00:00
nvd
nvd
CVE-2011-4030
2011-10-10 10:55:06
CVE-2011-3587
2011-10-10 10:55:06
cve
cve
CVE-2011-4030
2011-10-10 10:55:06
CVE-2011-3587
2011-10-10 10:55:06
prion
prion
Design/Logic Flaw
2011-10-10 10:55:00
Design/Logic Flaw
2011-10-10 10:55:00
seebug
seebug
Plone and Zope Remote Command Execution PoC
2014-07-01 00:00:00
Zopeζ‘†ζžΆ"cmd"ε‚ζ•°θΏœη¨‹ε‘½δ»€ζ‰§θ‘ŒζΌζ΄ž
2011-12-26 00:00:00
saint
saint
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
packetstorm
packetstorm
Plone and Zope Remote CMD Injection Exploit
2011-12-28 00:00:00
Plone / Zope Remote Command Execution
2011-12-21 00:00:00
dsquare
dsquare
Plone RCE
2012-01-26 00:00:00
osv
osv
Zope Command Execution Vulnerability
2022-05-17 05:37:39
nessus
nessus
Plone Request Parsing Remote Command Execution
2011-12-20 00:00:00
exploitpack
exploitpack
Plone and Zope - Remote Command Execution
2011-12-21 00:00:00
metasploit
metasploit
Plone and Zope XMLTools Remote Command Execution
2011-12-27 06:59:26
exploitdb
exploitdb
Plone and Zope - Remote Command Execution
2011-12-21 00:00:00
d2
d2
DSquare Exploit Pack: D2SEC_ZOPEPLONE
2011-10-10 10:55:00
checkpoint_advisories
checkpoint_advisories
Plone and Zope cmd Parameter Remote Command Execution (CVE-2011-3587)
2014-11-02 00:00:00
zdt
zdt
Plone and Zope Remote Command Execution PoC
2011-12-21 00:00:00
github
github
Zope Command Execution Vulnerability
2022-05-17 05:37:39
canvas
canvas
Immunity Canvas: PLONE
2011-10-10 10:55:00

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.2

Confidence

Low

EPSS

0.967

Percentile

99.7%

JSON
Related for GHSA-PWGM-JVQV-6V8P
cvelist2nvd2cve2prion2seebug2saint4packetstorm2dsquare1osv1nessus1exploitpack1metasploit1exploitdb1d21checkpoint_advisories1zdt1github1canvas1