PT-2014-2328 · Plone · Plone

Alessandro Sauzher · Published 2014-09-30 · Updated 2022-05-17 · CVE-2012-5501

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 4.2.0 through 4.2.3 Plone versions 4.3.0 through 4.3 beta 1

Description The issue allows remote attackers to read arbitrary BLOBs, including Files and Images, stored on custom content types via a crafted URL. This is possible due to a flaw in the at download.py script.

Recommendations For Plone versions 4.2.0 through 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3.0 through 4.3 beta 1, update to version 4.3 beta 1 or later. As a temporary workaround, consider restricting access to the at download.py script until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-5501

GHSA-PVHV-QWC8-R2PG

PYSEC-2014-43

Affected Products

Plone

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2012-5501 · Security Note
• https://plone.org/products/plone/security/advisories/20121106/17 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-43 · Vendor Advisory
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://osv.dev/vulnerability/GHSA-pvhv-qwc8-r2pg · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-43.yaml · Note
• https://github.com/plone/Plone · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5501 · Note