GitHub Advisoryadvisory · PyPI

GHSA-879r-7f3w-8jj3 Plone and Zope2 vulnerable to unauthorized access to restricted attributes

HIGH Published 2018-07-23 Modified 2024-10-11 Official page ↗
Aliases
CVE-2012-5489
Ecosystem
PyPI
Packages
Zope2, Plone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2020-06-16

Affected packages

• PyPI Zope2: < 2.12.21 → fixed in 2.12.21 • PyPI Zope2: >= 2.13.0, < 2.13.11 → fixed in 2.13.11 • PyPI Plone: >= 3.2.2, < 4.2.3 → fixed in 4.2.3 • PyPI Plone: >= 4.3a1, < 4.3b1 → fixed in 4.3b1

Description

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2012-5489 The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References