Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329021);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/22");

  script_cve_id(
    "CVE-2012-5485",
    "CVE-2012-5486",
    "CVE-2012-5487",
    "CVE-2012-5488",
    "CVE-2012-5489",
    "CVE-2012-5490",
    "CVE-2012-5491",
    "CVE-2012-5492",
    "CVE-2012-5493",
    "CVE-2012-5494",
    "CVE-2012-5495",
    "CVE-2012-5496",
    "CVE-2012-5497",
    "CVE-2012-5498",
    "CVE-2012-5499",
    "CVE-2012-5500",
    "CVE-2012-5501",
    "CVE-2012-5502",
    "CVE-2012-5503",
    "CVE-2012-5504",
    "CVE-2012-5505",
    "CVE-2012-5506",
    "CVE-2012-5507",
    "CVE-2012-5508",
    "CVE-2012-6661"
  );

  script_name(english:"Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following
vulnerabilities:

  - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors,
    related to the admin interface. (CVE-2012-5485)

  - ZPublisher.HTTPRequest._scrubHeader in Zope 2, as used in Plone, allows remote attackers to inject
    arbitrary HTTP headers via a linefeed (LF) character. (CVE-2012-5486)

  - The sandbox whitelisting function (allowmodule.py) in Plone allows remote authenticated users with certain
    privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related
    to importing. (CVE-2012-5487)

  - python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to
    createObject. (CVE-2012-5488)

  - The App.Undo.UndoSupport.get_request_var_or_attr function in Zope, as used in Plone, allows remote
    authenticated users to gain access to restricted attributes via unspecified vectors. (CVE-2012-5489)

  - Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone allows remote attackers to inject
    arbitrary web script or HTML via unspecified vectors. (CVE-2012-5490)

  - z3c.form, as used in Plone, allows remote attackers to obtain the default form field values by leveraging
    knowledge of the form location and the element id. (CVE-2012-5491)

  - uid_catalog.py in Plone allows remote attackers to obtain metadata about hidden objects via a crafted URL.
    (CVE-2012-5492)

  - gtbn.py in Plone allows remote authenticated users with certain permissions to bypass the Python sandbox
    and execute arbitrary Python code via unspecified vectors. (CVE-2012-5493)

  - Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone allows remote attackers to inject
    arbitrary web script or HTML via unspecified vectors, related to '{u,}translate'. (CVE-2012-5494)

  - python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to
    'go_back'. (CVE-2012-5495)

  - kupu_spellcheck.py in Kupu allows remote attackers to cause a denial of service (ZServer thread lock) via
    a crafted URL. (CVE-2012-5496)

  - membership_tool.py in Plone allows remote attackers to enumerate user account names via a crafted URL.
    (CVE-2012-5497)

  - queryCatalog.py in Plone allows remote attackers to bypass caching and cause a denial of service via a
    crafted request to a collection. (CVE-2012-5498)

  - python_scripts.py in Plone allows remote attackers to cause a denial of service (memory consumption) via a
    large value, related to formatColumns. (CVE-2012-5499)

  - The batch id change script (renameObjectsByPaths.py) in Plone allows remote attackers to change the titles
    of content items by leveraging a valid CSRF token in a crafted request. (CVE-2012-5500)

  - at_download.py in Plone allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom
    content types via a crafted URL. (CVE-2012-5501)

  - Cross-site scripting (XSS) vulnerability in safe_html.py in Plone allows remote authenticated users with
    permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
    (CVE-2012-5502)

  - ftp.py in Plone allows remote attackers to read hidden folder contents via unspecified vectors.
    (CVE-2012-5503)

  - Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone allows remote attackers to inject
    arbitrary web script or HTML via unspecified vectors. (CVE-2012-5504)

  - atat.py in Plone allows remote attackers to read private data structures via a request for a view without
    a name. (CVE-2012-5505)

  - python_scripts.py in Plone allows remote attackers to cause a denial of service (infinite loop) via an RSS
    feed request for a folder the user does not have permission to access. (CVE-2012-5506)

  - AccessControl/AuthEncoding.py in Zope, as used in Plone, allows remote attackers to obtain passwords via
    vectors involving timing discrepancies in password validation. (CVE-2012-5507)

  - The error pages in Plone allow remote attackers to obtain random numbers and derive the PRNG state for
    password resets via unspecified vectors. (CVE-2012-5508)

  - Zope, as used in Plone, does not reseed the pseudo-random number generator (PRNG), which makes it easier
    for remote attackers to guess the value via unspecified vectors. (CVE-2012-6661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number. Since a vendor hotfix (PloneHotfix20121106) may remediate this without a version upgrade, this plugin only
reports when running in Paranoid mode.");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2012/11/10/1");
  # https://web.archive.org/web/20140702020122/http://plone.org/products/plone/security/advisories/20121106-announcement
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f16fb65c");
  # https://web.archive.org/web/20140722005840/http://plone.org/products/plone-hotfix/releases/20121106
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f276dc79");
  script_set_attribute(attribute:"see_also", value:"https://plone.org/security/hotfix/20121106");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor hotfix (Products.PloneHotfix20121106), or upgrade to Plone version 4.2.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5487");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/11/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:plone");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("installed_sw/plone","Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'plone', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'paranoia': true}}],
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '4.2.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, check_backporting:true, flags:{'xss': true});
vdf::handle_check_and_report_errors(vdf_result:result);