PT-2024-19597 · Plone · Plone

Shenhav12 · CVE-2024-22889 · Published 2024-03-05 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plone version v6.0.9

Description The issue is due to incorrect access control, allowing remote attackers to view and list all files hosted on the website by sending a crafted request.

Recommendations For Plone version v6.0.9, update to a version that fixes the incorrect access control issue to prevent remote attackers from viewing and listing files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-22889

GHSA-XG5P-8WG5-RHXM

PYSEC-2026-1798

Affected Products

Plone

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22889.json · Exploit
• 🔥 https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22889 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1798 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22889 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xg5p-8wg5-rhxm · Vendor Advisory
• https://github.com/plone/Plone · Note
• https://github.com/advisories/GHSA-xg5p-8wg5-rhxm · Note
• https://t.me/cvenotify/108059 · Telegram Post
• https://twitter.com/CVEnew/status/1765163538086031380 · Twitter Post
• https://pypi.org/project/plone · Note
• https://t.me/cvenotify/100152 · Telegram Post
• https://t.me/cvenotify/73088 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1765190443027886519 · Twitter Post