PT-2014-2316 · Zope+1 · Zope+1

Tres Seaver · Publicado 2014-09-30 · Atualizado 2018-07-23 · CVE-2012-5489

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.12.21 Zope versions 2.13.x prior to 2.13.11 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote authenticated users to gain access to restricted attributes via unspecified vectors. This is due to a problem in the get request var or attr function of App.Undo.UndoSupport in Zope, which is also used in Plone.

Recommendations For Zope versions prior to 2.12.21, update to version 2.12.21 or later. For Zope versions 2.13.x prior to 2.13.11, update to version 2.13.11 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-264

CWE-863

Identificadores relacionados

CVE-2012-5489

GHSA-879R-7F3W-8JJ3

PYSEC-2014-31

PYSEC-2014-74

Produtos afetados

Plone

Zope

Referências · 13

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-74.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-31.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2014-31 · Aviso do Fabricante
• https://plone.org/products/plone/security/advisories/20121106/05 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5489 · Nota de Segurança
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://bugs.launchpad.net/zope2/+bug/1079238 · Nota
• https://osv.dev/vulnerability/GHSA-879r-7f3w-8jj3 · Aviso do Fabricante
• https://github.com/advisories/GHSA-879r-7f3w-8jj3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5489 · Nota
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-74 · Aviso do Fabricante