PYSEC-2020-90

vendorUSosv

view advisory published 2020-01-23Licence: CC-BY-4.0

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7941US	critical9.8	2.27% (83rd)	—	2020-01-23
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2020/01/24/1WEB
https://plone.org/security/hotfix/20200121WEB
https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-contentWEB
https://www.openwall.com/lists/oss-security/2020/01/22/1WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan