PT-2014-2313 · Plone+2 · Plone+2

David Glick + 1 · Publicado 2014-09-16 · Atualizado 2023-02-13 · CVE-2012-5486

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.3 beta 1

Description The issue allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character in the ZPublisher.HTTPRequest. scrubHeader function.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.3 beta 1, update to version 4.3 beta 1 or later.

Correção

Identificadores relacionados

CVE-2012-5486

GHSA-77HV-8796-8CCP

PYSEC-2014-28

PYSEC-2014-73

RHSA-2014:1194

RHSA-2014_1194

Produtos afetados

Plone

Red Hat

Zope

Referências · 24

• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-73.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-28.yaml · Nota
• https://access.redhat.com/security/cve/CVE-2012-5500 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5486 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-73 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2012-5498 · Nota
• https://bugs.launchpad.net/zope2/+bug/930812 · Nota
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://github.com/advisories/GHSA-77hv-8796-8ccp · Nota
• https://access.redhat.com/security/cve/CVE-2014-3521 · Nota
• https://plone.org/products/plone/security/advisories/20121106/02 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2012-5485 · Nota
• https://access.redhat.com/security/cve/CVE-2012-5497 · Nota
• https://access.redhat.com/errata/RHSA-2014:1194 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5486 · Nota de Segurança