Unscored severity · published Sep 30, 2014
CVE-2012-5507
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing…
–
CVSS
1.4%
EPSS
No
On KEV
Description
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plone · Plone
through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more · source: NVD
ZO
Zope · Zope
2.5.1; 2.6.1; 2.6.4; 2.7.0; 2.7.3; 2.7.4; +21 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5507
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/11/10/1
bugs.launchpad.net
https://bugs.launchpad.net/zope2/+bug/1071067
github.com
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
Patch
https://plone.org/products/plone-hotfix/releases/20121106
Vendor Advisory
https://plone.org/products/plone/security/advisories/20121106/23
More from Plone
9.9
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script
9.8
CVE-2020-35190
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user
9.8
CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission
8.8
CVE-2021-33926
An issue in Plone CMS v
8.8
CVE-2021-32633
Zope is an open-source web application server