PT-2011-4819 · Plone Foundation · Plone+1

Publicado 2011-10-10 · Atualizado 2022-05-17 · CVE-2011-4030

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plone versions 4.0.x through 4.0.9 Plone version 4.1 Plone versions 4.2 through 4.2a2 CMFEditions component version 2.x

Description The issue allows remote attackers to access sub-objects via unspecified vectors because the CMFEditions component does not prevent the KwAsAttributes classes from being publishable.

Recommendations For Plone versions 4.0.x through 4.0.9, consider restricting access to the CMFEditions component until a fix is available. For Plone version 4.1, restrict access to the CMFEditions component until a fix is available. For Plone versions 4.2 through 4.2a2, restrict access to the CMFEditions component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-4030

GHSA-PWGM-JVQV-6V8P

Produtos afetados

Cmfeditions

Plone

Referências · 10

• https://github.com/pypa/advisory-database/tree/main/vulns/products-plonehotfix20110928/PYSEC-2011-27.yaml · Nota
• https://github.com/plone/Plone · Nota
• http://secunia.com/advisories/46323 · Nota
• http://plone.org/products/plone-hotfix/releases/20110928 · Correção
• http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0 · Correção
• https://osv.dev/vulnerability/GHSA-pwgm-jvqv-6v8p · Aviso do Fabricante
• http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-4030 · Nota de Segurança
• http://securityfocus.com/bid/50287 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4030 · Nota