CVE-2021-33509
highpriority · track · 41EPSS 0.020 · 80 %ileEUUSEPSS · scored 2026-10-27
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.5–9.9
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-hm2p-fhwx-9285Incorrect Permission Assignment for Critical Resource in Plone2021-06-15ghsa · osvUS
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
- PYSEC-2021-812021-05-21vendor · osvUS
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2021/05/22/1cnnvd
- https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-scriptcnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021052811cnnvd
- http://www.openwall.com/lists/oss-security/2021/05/22/1enisa_euvd
- https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-scriptenisa_euvd
- http://www.openwall.com/lists/oss-security/2021/05/22/1Mailing ListThird Party Advisorynvd
- https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-scriptVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan