PT-2014-2326 · Plone+1 · Plone+1

Richard Mitchell · Published 2014-09-16 · Updated 2023-02-13 · CVE-2012-5499

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a large value. This is related to the formatColumns function.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later. As a temporary workaround, consider restricting access to the formatColumns function until a patch is available.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-399

CWE-770

Related Identifiers

CVE-2012-5499

GHSA-WRF2-2RCH-CMR9

PYSEC-2014-41

RHSA-2014:1194

RHSA-2014_1194

Affected Products

Plone

Red Hat

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2012-5499 · Security Note
• https://plone.org/products/plone/security/advisories/20121106/15 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-41 · Vendor Advisory
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://osv.dev/vulnerability/GHSA-wrf2-2rch-cmr9 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1194.html · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-41.yaml · Note
• https://github.com/plone/Plone · Note
• https://access.redhat.com/security/cve/CVE-2012-5500 · Note
• https://access.redhat.com/security/cve/CVE-2012-5498 · Note
• https://access.redhat.com/security/cve/CVE-2014-3521 · Note
• https://access.redhat.com/security/cve/CVE-2012-5485 · Note
• https://access.redhat.com/security/cve/CVE-2012-5497 · Note
• https://access.redhat.com/errata/RHSA-2014:1194 · Note