PT-2017-8449 · Plone Foundation · Plone

Published 2017-02-24 · Updated 2022-05-17 · CVE-2016-4042

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 3.3 through 5.1a1 Plone versions 5.x before 5.0.5 and 3.3 before 4.3.10 can be consolidated into the above range for simplicity, but to maintain precision: Plone versions 3.3 through 4.3.9 Plone versions 5.x before 5.0.5

Description The issue allows remote attackers to obtain information about the ID of sensitive content. The exact vectors used for this are not specified.

Recommendations For Plone versions 3.3 through 4.3.9, update to version 4.3.10 or later. For Plone versions 5.x before 5.0.5, update to version 5.0.5 or later. As a temporary workaround, consider restricting access to sensitive content until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-4042

GHSA-V4VJ-49M5-WJHW

PYSEC-2017-56

Affected Products

Plone

References · 9

• https://osv.dev/vulnerability/CVE-2016-4042 · Vendor Advisory
• https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v4vj-49m5-wjhw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4042 · Security Note
• https://osv.dev/vulnerability/PYSEC-2017-56 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-56.yaml · Note
• https://github.com/plone/Plone · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4042 · Note
• http://openwall.com/lists/oss-security/2016/04/20/2 · Note