Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2011-4030US | high9.3 | — | ||
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attac… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://plone.org/products/plone-hotfix/releases/20110928WEB
- http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zipWEB
- http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0WEB
- https://github.com/plone/PlonePACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/products-plonehotfix20110928/PYSEC-2011-27.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2011-4030ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan