PT-2007-1023 · Plone · Plone

Published 2007-11-07 · Updated 2022-05-01 · CVE-2007-5741

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Plone versions 2.5 through 2.5.4 Plone versions 3.0 through 3.0.2

Description: The issue allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the statusmessages or linkintegrity module. Multiple vulnerabilities in the plone-site package may lead to disruption of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations: For Plone versions 2.5 through 2.5.4, consider disabling the statusmessages and linkintegrity modules to minimize the risk of exploitation. For Plone versions 3.0 through 3.0.2, restrict access to the statusmessages and linkintegrity modules until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-02786

CVE-2007-5741

DSA-1405-1

DSA-1405-2

GHSA-HF26-VVMX-X8C8

PYSEC-2007-4

Affected Products

Plone

References · 22

• http://secunia.com/advisories/27530 · Vendor Advisory
• http://debian.org/security/2007/dsa-1405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5741 · Security Note
• http://securityfocus.com/bid/26354 · Patch
• https://osv.dev/vulnerability/GHSA-hf26-vvmx-x8c8 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2007-4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02786 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5741 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml · Note
• https://github.com/plone/Plone · Note
• http://plone.org/about/security/advisories/cve-2007-5741 · Note
• https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741 · Note
• http://osvdb.org/42071 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38288 · Note
• http://secunia.com/advisories/27559 · Note