PT-2014-2334 · Plone+1 · Plone+1

Christian Heimes · Publicado 2014-09-30 · Atualizado 2018-07-23 · CVE-2012-5507

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2012-5507

GHSA-3QPR-7RMG-73V8

PYSEC-2014-49

PYSEC-2014-75

Produtos afetados

Plone

Zope

Referências · 13

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-75.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-49.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5507 · Nota de Segurança
• https://bugs.launchpad.net/zope2/+bug/1071067 · Nota
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://osv.dev/vulnerability/PYSEC-2014-75 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3qpr-7rmg-73v8 · Aviso do Fabricante
• https://plone.org/products/plone/security/advisories/20121106/23 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5507 · Nota
• https://github.com/advisories/GHSA-3qpr-7rmg-73v8 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-49 · Aviso do Fabricante