PT-2020-1633 · Plone Foundation · Plone

Damiano Esposito · Published 2020-01-21 · Updated 2022-05-24 · CVE-2020-7941

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plone versions 4.3 through 5.2.1

Description The issue is related to a privilege escalation problem in the plone.app.contenttypes package of the Plone content management system. This allows users to overwrite certain content using the PUT method without requiring write permission. The vulnerability can be exploited by a remote attacker to elevate their privileges.

Recommendations For Plone versions 4.3 through 5.2.1, consider restricting access to the plone.app.contenttypes package until a fix is available. As a temporary workaround, limit the ability of users to PUT content without proper write permissions to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-00839

CVE-2020-7941

GHSA-W6G9-XCCC-347H

PYSEC-2020-90

Affected Products

Plone

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-7941 · Security Note
• https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content · Vendor Advisory
• https://plone.org/security/hotfix/20200121 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00839 · Security Note
• https://osv.dev/vulnerability/GHSA-w6g9-xccc-347h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-90 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7941 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-90.yaml · Note
• https://github.com/plone/plone.app.contenttypes · Note
• https://github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1#L372-L374 · Note
• http://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://openwall.com/lists/oss-security/2020/01/22/1 · Note