SB2025060834 - Permissions, Privileges, and Access Controls in Zope

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-5489)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to read and manipulate data.

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2012/11/10/1
• https://bugs.launchpad.net/zope2/+bug/1079238
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
• https://plone.org/products/plone/security/advisories/20121106/05
• https://plone.org/products/plone-hotfix/releases/20121106