PT-2017-9086 · Plone · Plone Cms

Sebastian Perez · Published 2017-03-07 · Updated 2022-05-14 · CVE-2016-7135

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone CMS versions 4.2.x through 4.3.11 Plone CMS versions 5.x through 5.0.6

Description The issue allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to the Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions endpoint.

Recommendations For Plone CMS versions 4.2.x through 4.3.11, update to a version outside of this range to resolve the issue. For Plone CMS versions 5.x through 5.0.6, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions endpoint to minimize the risk of exploitation. Avoid using the path parameter in the affected getFile action until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-7135

GHSA-M7F9-65WR-PWCH

PYSEC-2017-58

Affected Products

Plone Cms

References · 17

• 🔥 http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html · Exploit
• http://openwall.com/lists/oss-security/2016/09/05/5 · Patch
• https://plone.org/security/hotfix/20160830/filesystem-information-leak · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-58 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7135 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7135 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/09/05/4 · Patch
• https://osv.dev/vulnerability/GHSA-m7f9-65wr-pwch · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-58.yaml · Note
• https://github.com/plone/Plone · Note
• https://pypi.org/project/Products.PloneHotfix20160830 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7135 · Note
• https://web.archive.org/web/20200227230348/http://securityfocus.com/bid/92752 · Note
• http://seclists.org/fulldisclosure/2016/Oct/80 · Note
• http://securityfocus.com/archive/1/539572/100/0/threaded · Note