PT-2014-2316 · Zope+1 · Zope+1

Tres Seaver · Published 2014-09-30 · Updated 2018-07-23 · CVE-2012-5489

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.12.21 Zope versions 2.13.x prior to 2.13.11 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote authenticated users to gain access to restricted attributes via unspecified vectors. This is due to a problem in the get request var or attr function of App.Undo.UndoSupport in Zope, which is also used in Plone.

Recommendations For Zope versions prior to 2.12.21, update to version 2.12.21 or later. For Zope versions 2.13.x prior to 2.13.11, update to version 2.13.11 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-264

CWE-863

Related Identifiers

CVE-2012-5489

GHSA-879R-7F3W-8JJ3

PYSEC-2014-31

PYSEC-2014-74

Affected Products

Plone

Zope

References · 13

• https://osv.dev/vulnerability/PYSEC-2014-31 · Vendor Advisory
• https://plone.org/products/plone/security/advisories/20121106/05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5489 · Security Note
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://osv.dev/vulnerability/GHSA-879r-7f3w-8jj3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-74 · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-74.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-31.yaml · Note
• https://bugs.launchpad.net/zope2/+bug/1079238 · Note
• https://github.com/advisories/GHSA-879r-7f3w-8jj3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5489 · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note