PT-2014-2423 · Plone+1 · Plone+1

Christian Heimes · Published 2014-11-03 · Updated 2018-07-23 · CVE-2012-6661

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Exploit

Fix

Weakness Enumeration

CWE-336

CWE-310

Related Identifiers

CVE-2012-6661

GHSA-48VV-2PMQ-9FVV

PYSEC-2014-51

PYSEC-2014-76

Affected Products

Plone

Zope

References · 14

• 🔥 https://bugs.launchpad.net/zope2/+bug/1071067 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6661 · Security Note
• https://osv.dev/vulnerability/GHSA-48vv-2pmq-9fvv · Vendor Advisory
• https://plone.org/products/plone/security/advisories/20121106/24 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-51 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-76 · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/plone/Products.CMFPlone · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-76.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-51.yaml · Note
• https://github.com/advisories/GHSA-48vv-2pmq-9fvv · Note
• https://plone.org/products/plone-hotfix/releases/20121124 · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6661 · Note