PT-2014-2328 · Plone · Plone

Alessandro Sauzher · Publicado 2014-09-30 · Atualizado 2022-05-17 · CVE-2012-5501

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 4.2.0 through 4.2.3 Plone versions 4.3.0 through 4.3 beta 1

Description The issue allows remote attackers to read arbitrary BLOBs, including Files and Images, stored on custom content types via a crafted URL. This is possible due to a flaw in the at download.py script.

Recommendations For Plone versions 4.2.0 through 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3.0 through 4.3 beta 1, update to version 4.3 beta 1 or later. As a temporary workaround, consider restricting access to the at download.py script until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-5501

GHSA-PVHV-QWC8-R2PG

PYSEC-2014-43

Produtos afetados

Plone

Referências · 10

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-43.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5501 · Nota de Segurança
• https://plone.org/products/plone/security/advisories/20121106/17 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-43 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5501 · Nota
• https://osv.dev/vulnerability/GHSA-pvhv-qwc8-r2pg · Aviso do Fabricante