PT-2011-4819 · Plone Foundation · Plone+1

Published 2011-10-10 · Updated 2022-05-17 · CVE-2011-4030

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plone versions 4.0.x through 4.0.9 Plone version 4.1 Plone versions 4.2 through 4.2a2 CMFEditions component version 2.x

Description The issue allows remote attackers to access sub-objects via unspecified vectors because the CMFEditions component does not prevent the KwAsAttributes classes from being publishable.

Recommendations For Plone versions 4.0.x through 4.0.9, consider restricting access to the CMFEditions component until a fix is available. For Plone version 4.1, restrict access to the CMFEditions component until a fix is available. For Plone versions 4.2 through 4.2a2, restrict access to the CMFEditions component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-4030

GHSA-PWGM-JVQV-6V8P

Affected Products

Cmfeditions

Plone

References · 10

• http://plone.org/products/plone-hotfix/releases/20110928 · Patch
• http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0 · Patch
• https://osv.dev/vulnerability/GHSA-pwgm-jvqv-6v8p · Vendor Advisory
• http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-4030 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/products-plonehotfix20110928/PYSEC-2011-27.yaml · Note
• https://github.com/plone/Plone · Note
• http://secunia.com/advisories/46323 · Note
• http://securityfocus.com/bid/50287 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4030 · Note