PT-2014-2333 · Plone · Plone

David Beitey · Publicado 2014-09-30 · Atualizado 2022-05-17 · CVE-2012-5506

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending an RSS feed request for a folder that the user does not have permission to access.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

CVE-2012-5506

GHSA-79HJ-474H-V4XV

PYSEC-2014-48

Produtos afetados

Plone

Referências · 10

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-48.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://plone.org/products/plone/security/advisories/20121106/22 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5506 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5506 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://osv.dev/vulnerability/PYSEC-2014-48 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-79hj-474h-v4xv · Aviso do Fabricante