PT-2011-3915 · Zope+1 · Zope+1

Vincent Danen · Published 2011-07-19 · Updated 2018-07-23 · CVE-2011-2528

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zope versions 2.12.x through 2.12.18 Zope versions 2.13.x through 2.13.7 PloneHotfix20110720 for Plone 3.x

Description The issue allows attackers to gain privileges via unspecified vectors, related to a highly serious vulnerability. This vulnerability exists because of an incorrect fix for a previous issue.

Recommendations For Zope versions 2.12.x through 2.12.18, update to version 2.12.19 or later. For Zope versions 2.13.x through 2.13.7, update to version 2.13.8 or later. For Plone 3.x with PloneHotfix20110720 applied, consider removing the hotfix and applying a corrected fix to mitigate the risk of exploitation.

Fix

Related Identifiers

CVE-2011-2528

GHSA-P6H9-HPCG-C6GM

PYSEC-2011-25

PYSEC-2011-32

Affected Products

Plone

Zope

References · 18

• http://secunia.com/advisories/45056 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2011-32 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/07/04/6 · Patch
• http://plone.org/products/plone-hotfix/releases/20110622 · Vendor Advisory
• https://mail.zope.org/pipermail/zope-announce/2011-June/002260.html · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=718824 · Patch
• http://openwall.com/lists/oss-security/2011/07/12/9 · Patch
• http://plone.org/products/plone/security/advisories/20110622 · Vendor Advisory
• http://secunia.com/advisories/45111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2528 · Security Note
• https://osv.dev/vulnerability/PYSEC-2011-25 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6h9-hpcg-c6gm · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-32.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-25.yaml · Note
• https://plone.org/products/plone/security/advisories/20110622 · Note