GitHub Advisoryadvisory · PyPI

GHSA-f8pg-wp5j-rjxx Plone Information Disclosure

MEDIUM Published 2022-05-17 Modified 2024-10-11 Official page ↗
Aliases
CVE-2012-5491
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-29

Affected packages

• PyPI Plone: < 4.2.3 → fixed in 4.2.3 • PyPI Plone: >= 4.3a0, < 4.3b1 → fixed in 4.3b1

Description

`z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.

Related

Alias · CVE (1)

  • CVE-2012-5491 z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References