GitHub Advisoryadvisory · PyPI
GHSA-hf26-vvmx-x8c8 Plone Arbitrary Code Execution via Unsafe Handling of Pickles
CRITICAL
Official page ↗
- Aliases
- CVE-2007-5741
- Ecosystem
- PyPI
- Packages
- Plone
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2023-09-22
Affected packages
• PyPI Plone: >= 2.5, < 2.5.5 → fixed in 2.5.5
• PyPI Plone: >= 3.0, < 3.0.3 → fixed in 3.0.3
Description
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
Related
Alias · CVE (1)
- CVE-2007-5741 Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-5741 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38288 web
- https://github.com/plone/Plone package
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml web
- https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741 web
- https://web.archive.org/web/20080517012557/http://www.securityfocus.com/bid/26354 web
- https://web.archive.org/web/20080906150436/http://www.securityfocus.com/archive/1/483343/100/0/threaded web
- http://plone.org/about/security/advisories/cve-2007-5741 web
- http://www.debian.org/security/2007/dsa-1405 web