GitHub Advisoryadvisory · PyPI

GHSA-pwgm-jvqv-6v8p Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

HIGH Published 2022-05-17 Modified 2024-11-22 Official page ↗
Aliases
CVE-2011-4030
Ecosystem
PyPI
Packages
Plone
Severity
High
Reviewed
2024-05-14

Affected packages

• PyPI Plone: >= 4.0, < 4.0.10 → fixed in 4.0.10 • PyPI Plone: >= 4.1, < 4.1.1 → fixed in 4.1.1 • PyPI Plone: >= 4.2a1, < 4.2a3 → fixed in 4.2a3

Description

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Related

Alias · CVE (1)

  • CVE-2011-4030 The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from… vulnerability

References