Unscored severity · published Jul 19, 2011
CVE-2011-2528
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows…
–
CVSS
2%
EPSS
No
On KEV
Description
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plone · Plone
3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +30 more · source: NVD
PH
Plone Hotfix 20110720 · Plone
All versions, or not specified · source: NVD
ZO
Zope · Zope
2.12.0; 2.12.0; 2.12.0; 2.12.0; 2.12.0; 2.12.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2528
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2528
Patch
http://plone.org/products/plone-hotfix/releases/20110622
Patch
http://plone.org/products/plone/security/advisories/20110622
Vendor Advisory
http://secunia.com/advisories/45056
Vendor Advisory
http://secunia.com/advisories/45111
Patch
http://www.openwall.com/lists/oss-security/2011/07/04/6
Patch
http://www.openwall.com/lists/oss-security/2011/07/12/9
More from Plone
9.9
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script
9.8
CVE-2020-35190
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user
9.8
CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission
8.8
CVE-2021-33926
An issue in Plone CMS v
8.8
CVE-2021-32633
Zope is an open-source web application server