Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-PWGM-JVQV-6V8P
HistoryMay 17, 2022 - 5:37 a.m.

Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

2022-05-1705:37:14
GitHub Advisory Database
github.com
1

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.969 High

EPSS

Percentile

99.7%

JSON

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Affected configurations

Vulners
Node
ploneploneRange≀4.2a2
OR
ploneploneRange<4.1.1
OR
ploneploneRange≀4.0.9
CPENameOperatorVersion
plonele4.2a2
plonelt4.1.1
plonele4.0.9

Related

prion 2
nvd 2
cvelist 2
cve 2
exploitpack 1
saint 4
seebug 2
packetstorm 2
d2 1
checkpoint_advisories 1
github 1
canvas 1
nessus 1
dsquare 1
osv 1
exploitdb 1
prion
prion
Design/Logic Flaw
2011-10-10 10:55:00
Design/Logic Flaw
2011-10-10 10:55:00
nvd
nvd
CVE-2011-4030
2011-10-10 10:55:06
CVE-2011-3587
2011-10-10 10:55:06
cvelist
cvelist
CVE-2011-4030
2011-10-10 10:00:00
CVE-2011-3587
2011-10-10 10:00:00
cve
cve
CVE-2011-4030
2011-10-10 10:55:06
CVE-2011-3587
2011-10-10 10:55:06
exploitpack
exploitpack
Plone and Zope - Remote Command Execution
2011-12-21 00:00:00
saint
saint
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
Plone Zope SAXutils Command Execution
2012-01-13 00:00:00
seebug
seebug
Plone and Zope Remote Command Execution PoC
2014-07-01 00:00:00
Zopeζ‘†ζžΆ&quot;cmd&quot;ε‚ζ•°θΏœη¨‹ε‘½δ»€ζ‰§θ‘ŒζΌζ΄ž
2011-12-26 00:00:00
packetstorm
packetstorm
Plone and Zope Remote CMD Injection Exploit
2011-12-28 00:00:00
Plone / Zope Remote Command Execution
2011-12-21 00:00:00
d2
d2
DSquare Exploit Pack: D2SEC_ZOPEPLONE
2011-10-10 10:55:00
checkpoint_advisories
checkpoint_advisories
Plone and Zope cmd Parameter Remote Command Execution (CVE-2011-3587)
2014-11-02 00:00:00
github
github
Zope Command Execution Vulnerability
2022-05-17 05:37:39
canvas
canvas
Immunity Canvas: PLONE
2011-10-10 10:55:00
nessus
nessus
Plone Request Parsing Remote Command Execution
2011-12-20 00:00:00
dsquare
dsquare
Plone RCE
2012-01-26 00:00:00
osv
osv
Zope Command Execution Vulnerability
2022-05-17 05:37:39
exploitdb
exploitdb
Plone and Zope - Remote Command Execution
2011-12-21 00:00:00

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.969 High

EPSS

Percentile

99.7%

JSON
Related for GHSA-PWGM-JVQV-6V8P
prion2nvd2cvelist2cve2exploitpack1saint4seebug2packetstorm2d21checkpoint_advisories1github1canvas1nessus1dsquare1osv1exploitdb1