Lucene search
HistoryFeb 08, 2024 - 9:15 p.m.
CVE-2024-23756
cve-2024-23756
plone
docker
http methods
security vulnerability
nvd
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.0005 Low
EPSS
Percentile
18.0%
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.
Affected configurations
Node
ploneploneMatch5.2.13
| CPE | Name | Operator | Version |
|---|---|---|---|
| plone:plone | plone | eq | 5.2.13 |
Related
prion
prion
Design/Logic Flaw
2024-02-08 21:15:00
cvelist
cvelist
CVE-2024-23756
2024-02-08 00:00:00
nvd
nvd
CVE-2024-23756
2024-02-08 21:15:08
osv
osv
CVE-2024-23756
2024-02-08 21:15:08
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.0005 Low
EPSS
Percentile
18.0%
Related for CVE-2024-23756