Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-HF26-VVMX-X8C8
HistoryMay 01, 2022 - 6:36 p.m.

Plone Arbitrary Code Execution via Unsafe Handling of Pickles

2022-05-0118:36:14
CWE-94
GitHub Advisory Database
github.com
5

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.021 Low

EPSS

Percentile

89.1%

JSON

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

CPENameOperatorVersion
plonele3.0.2
plonele2.5.4

Related

securityvulns 2
debian 3
nessus 2
osv 3
openvas 8
freebsd 1
ubuntucve 1
prion 1
cve 1
securityvulns
securityvulns
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2007-11-07 00:00:00
[CVE-2007-5741] Plone: statusmessages and linkintegrity unsafe network data hotfix
2007-11-07 00:00:00
debian
debian
[SECURITY] [DSA 1405-1] New zope-cmfplone packages fix arbitrary code execution
2007-11-09 22:38:37
[SECURITY] [DSA 1405-2] New zope-cmfplone packages fix regression
2007-11-11 16:43:44
[SECURITY] [DSA 1405-3] New zope-cmfplone packages fix regression
2007-12-27 21:21:06
nessus
nessus
Debian DSA-1405-3 : zope-cmfplone - missing input sanitising
2007-11-12 00:00:00
FreeBSD : plone -- unsafe data interpreted as pickles (ffba6ab0-90b5-11dc-9835-003048705d5a)
2007-11-12 00:00:00
osv
osv
Plone Arbitrary Code Execution via Unsafe Handling of Pickles
2022-05-01 18:36:14
zope-cmfplone - arbitrary code
2007-11-09 00:00:00
zope-cmfplone - arbitrary code
2007-11-09 00:00:00
openvas
openvas
Debian Security Advisory DSA 1405-2 (zope-cmfplone)
2008-01-17 00:00:00
FreeBSD Ports: plone
2008-09-04 00:00:00
Debian Security Advisory DSA 1405-3 (zope-cmfplone)
2008-01-17 00:00:00
freebsd
freebsd
plone -- unsafe data interpreted as pickles
2007-11-06 00:00:00
ubuntucve
ubuntucve
CVE-2007-5741
2007-11-07 00:00:00
prion
prion
Code injection
2007-11-07 21:46:00
cve
cve
CVE-2007-5741
2007-11-07 21:46:00

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.021 Low

EPSS

Percentile

89.1%

JSON
Related for GHSA-HF26-VVMX-X8C8
securityvulns2debian3nessus2osv3openvas8freebsd1ubuntucve1prion1cve1