Unscored severity · published Sep 30, 2014
CVE-2012-5489
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote…
–
CVSS
1.9%
EPSS
No
On KEV
Description
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plone · Plone
through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more · source: NVD
ZO
Zope · Zope
through 2.13.10; 2.5.1; 2.6.1; 2.6.4; 2.7.0; 2.7.3; +31 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5489
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/11/10/1
bugs.launchpad.net
https://bugs.launchpad.net/zope2/+bug/1079238
github.com
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
Patch
https://plone.org/products/plone-hotfix/releases/20121106
Vendor Advisory
https://plone.org/products/plone/security/advisories/20121106/05
More from Plone
9.9
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script
9.8
CVE-2020-35190
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user
9.8
CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission
8.8
CVE-2021-33926
An issue in Plone CMS v
8.8
CVE-2021-32633
Zope is an open-source web application server