PT-2020-19860 · Plone Foundation · Plone

Damiano Esposito · Published 2020-01-23 · Updated 2022-05-24 · CVE-2020-7938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plone versions 5.2.0 through 5.2.1

Description The issue allows users with a certain privilege level to escalate their privileges up to the highest level.

Recommendations For Plone versions 5.2.0 through 5.2.1, update to a version that contains a fix for this issue to prevent privilege escalation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-7938

GHSA-CJG3-Q24H-9QWF

PYSEC-2020-87

Affected Products

Plone

References · 11

• https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7938 · Vendor Advisory
• https://plone.org/security/hotfix/20200121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjg3-q24h-9qwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7938 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-87 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-87.yaml · Note
• https://github.com/plone/plone.restapi/issues/857 · Note
• https://github.com/plone/plone.restapi/pull/859 · Note
• http://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://openwall.com/lists/oss-security/2020/01/22/1 · Note