PT-2014-2423 · Plone+1 · Plone+1

Christian Heimes · Publicado 2014-11-03 · Atualizado 2018-07-23 · CVE-2012-6661

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-336

CWE-310

Identificadores relacionados

CVE-2012-6661

GHSA-48VV-2PMQ-9FVV

PYSEC-2014-51

PYSEC-2014-76

Produtos afetados

Plone

Zope

Referências · 14

• 🔥 https://bugs.launchpad.net/zope2/+bug/1071067 · Exploit
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/plone/Products.CMFPlone · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-76.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-51.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6661 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-48vv-2pmq-9fvv · Aviso do Fabricante
• https://plone.org/products/plone/security/advisories/20121106/24 · Aviso do Fabricante
• https://github.com/advisories/GHSA-48vv-2pmq-9fvv · Nota
• https://osv.dev/vulnerability/PYSEC-2014-51 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-76 · Aviso do Fabricante
• https://plone.org/products/plone-hotfix/releases/20121124 · Nota
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6661 · Nota