PT-2014-2313 · Plone+2 · Plone+2

David Glick + 1 · Published 2014-09-16 · Updated 2023-02-13 · CVE-2012-5486

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.3 beta 1

Description The issue allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character in the ZPublisher.HTTPRequest. scrubHeader function.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.3 beta 1, update to version 4.3 beta 1 or later.

Fix

Related Identifiers

CVE-2012-5486

GHSA-77HV-8796-8CCP

PYSEC-2014-28

PYSEC-2014-73

RHSA-2014:1194

RHSA-2014_1194

Affected Products

Plone

Red Hat

Zope

References · 24

• https://osv.dev/vulnerability/PYSEC-2014-73 · Vendor Advisory
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://plone.org/products/plone/security/advisories/20121106/02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5486 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1194.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-28 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77hv-8796-8ccp · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-73.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-28.yaml · Note
• https://access.redhat.com/security/cve/CVE-2012-5500 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5486 · Note
• https://access.redhat.com/security/cve/CVE-2012-5498 · Note
• https://bugs.launchpad.net/zope2/+bug/930812 · Note
• https://github.com/advisories/GHSA-77hv-8796-8ccp · Note
• https://access.redhat.com/security/cve/CVE-2014-3521 · Note