PT-2007-1023 · Plone · Plone

Publicado 2007-11-07 · Atualizado 2022-05-01 · CVE-2007-5741

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Plone versions 2.5 through 2.5.4 Plone versions 3.0 through 3.0.2

Description: The issue allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the statusmessages or linkintegrity module. Multiple vulnerabilities in the plone-site package may lead to disruption of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations: For Plone versions 2.5 through 2.5.4, consider disabling the statusmessages and linkintegrity modules to minimize the risk of exploitation. For Plone versions 3.0 through 3.0.2, restrict access to the statusmessages and linkintegrity modules until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2015-02786

CVE-2007-5741

DSA-1405-1

DSA-1405-2

GHSA-HF26-VVMX-X8C8

PYSEC-2007-4

Produtos afetados

Plone

Referências · 22

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml · Nota
• https://github.com/plone/Plone · Nota
• http://secunia.com/advisories/27530 · Aviso do Fabricante
• http://debian.org/security/2007/dsa-1405 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-5741 · Nota de Segurança
• http://plone.org/about/security/advisories/cve-2007-5741 · Nota
• http://securityfocus.com/bid/26354 · Correção
• https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741 · Nota
• http://osvdb.org/42071 · Nota
• https://osv.dev/vulnerability/GHSA-hf26-vvmx-x8c8 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2007-4 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38288 · Nota
• https://bdu.fstec.ru/vul/2015-02786 · Nota de Segurança
• http://secunia.com/advisories/27559 · Nota
• https://web.archive.org/web/20080906150436/http://securityfocus.com/archive/1/483343/100/0/threaded · Nota