PT-2017-8449 · Plone Foundation · Plone

Publicado 2017-02-24 · Atualizado 2022-05-17 · CVE-2016-4042

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 3.3 through 5.1a1 Plone versions 5.x before 5.0.5 and 3.3 before 4.3.10 can be consolidated into the above range for simplicity, but to maintain precision: Plone versions 3.3 through 4.3.9 Plone versions 5.x before 5.0.5

Description The issue allows remote attackers to obtain information about the ID of sensitive content. The exact vectors used for this are not specified.

Recommendations For Plone versions 3.3 through 4.3.9, update to version 4.3.10 or later. For Plone versions 5.x before 5.0.5, update to version 5.0.5 or later. As a temporary workaround, consider restricting access to sensitive content until a patch is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-4042

GHSA-V4VJ-49M5-WJHW

PYSEC-2017-56

Produtos afetados

Plone

Referências · 9

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-56.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://osv.dev/vulnerability/CVE-2016-4042 · Aviso do Fabricante
• https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v4vj-49m5-wjhw · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4042 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4042 · Nota
• https://osv.dev/vulnerability/PYSEC-2017-56 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/04/20/2 · Nota