Plone Arbitrary Code Execution via Unsafe Handling of Pickles
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2007-5741US | high7.5 | — | ||
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2)… | ||||
02
references
External citations — patches, advisories, analysis.
- http://plone.org/about/security/advisories/cve-2007-5741WEB
- http://www.debian.org/security/2007/dsa-1405WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38288WEB
- https://github.com/plone/PlonePACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2007-5741ADVISORY
- https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741WEB
- https://web.archive.org/web/20080517012557/http://www.securityfocus.com/bid/26354WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan