PT-2014-2334 · Plone+1 · Plone+1

Christian Heimes · Published 2014-09-30 · Updated 2018-07-23 · CVE-2012-5507

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2012-5507

GHSA-3QPR-7RMG-73V8

PYSEC-2014-49

PYSEC-2014-75

Affected Products

Plone

Zope

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2012-5507 · Security Note
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://osv.dev/vulnerability/PYSEC-2014-75 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qpr-7rmg-73v8 · Vendor Advisory
• https://plone.org/products/plone/security/advisories/20121106/23 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-49 · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-75.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-49.yaml · Note
• https://bugs.launchpad.net/zope2/+bug/1071067 · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5507 · Note
• https://github.com/advisories/GHSA-3qpr-7rmg-73v8 · Note