PT-2011-4958 · Plone · Plone

Alexander Klink + 1 · Published 2011-12-30 · Updated 2018-07-23 · CVE-2011-4462

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 4.1.3 and earlier

Description The issue allows remote attackers to cause a denial of service by sending many crafted parameters, resulting in CPU consumption due to hash collisions.

Recommendations For Plone versions 4.1.3 and earlier, update to a version later than 4.1.3 to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4462

GHSA-PCWM-8JC3-QXVJ

PYSEC-2011-22

Affected Products

Plone

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2011-4462 · Security Note
• https://osv.dev/vulnerability/PYSEC-2011-22 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pcwm-8jc3-qxvj · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-22.yaml · Note
• https://github.com/plone/plone · Note
• https://github.com/advisories/GHSA-pcwm-8jc3-qxvj · Note
• http://secunia.com/advisories/47406 · Note
• http://nruns.com/_downloads/advisory28122011.pdf · Note
• http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html · Note
• http://ocert.org/advisories/ocert-2011-003.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72018 · Note
• http://kb.cert.org/vuls/id/903934 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4462 · Note