PT-2014-2333 · Plone · Plone

David Beitey · Published 2014-09-30 · Updated 2022-05-17 · CVE-2012-5506

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending an RSS feed request for a folder that the user does not have permission to access.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2012-5506

GHSA-79HJ-474H-V4XV

PYSEC-2014-48

Affected Products

Plone

References · 10

• https://plone.org/products/plone/security/advisories/20121106/22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5506 · Security Note
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://osv.dev/vulnerability/PYSEC-2014-48 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79hj-474h-v4xv · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-48.yaml · Note
• https://github.com/plone/Plone · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5506 · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note