GitHub Advisoryadvisory · PyPI

GHSA-4vr8-r7qr-fpvq Plone Privilege escalation through exposed underlying API

MEDIUM Published 2022-05-17 Modified 2024-10-15 Official page ↗
Aliases
CVE-2013-7061
Ecosystem
PyPI
Packages
Plone, Products.CMFPlone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-04-29

Affected packages

• PyPI Plone: >= 3.3b1, < 4.3.3 → fixed in 4.3.3 • PyPI Products.CMFPlone: >= 3.3, < 4.3.3 → fixed in 4.3.3

Description

`Products/CMFPlone/CatalogTool.py` in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.

Related

Alias · CVE (1)

  • CVE-2013-7061 Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References