CVE-2011-4030 Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
HighCVSS 9.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | >= 4.0, < 4.0.10 | 4.0.10 |
| pypi plone(PyPI) | = 4.0 | No fix listed |
| pypi plone(PyPI) | = 4.0.1 | No fix listed |
| pypi plone(PyPI) | = 4.0.2 | No fix listed |
| pypi plone(PyPI) | = 4.0.3 | No fix listed |
| pypi plone(PyPI) | = 4.0.4 | No fix listed |
| pypi plone(PyPI) | = 4.0.5 | No fix listed |
| pypi plone(PyPI) | = 4.0.6 | No fix listed |
| pypi plone(PyPI) | = 4.0.7 | No fix listed |
| pypi plone(PyPI) | = 4.0.8 | No fix listed |
| pypi plone(PyPI) | = 4.0.9 | No fix listed |
| pypi plone(PyPI) | >= 4.1, < 4.1.1 | 4.1.1 |
| pypi plone(PyPI) | = 4.1 | No fix listed |
| pypi plone(PyPI) | >= 4.2a1, < 4.2a3 | 4.2a3 |
| pypi plone(PyPI) | = 4.2a1 | No fix listed |
| pypi plone(PyPI) | = 4.2a2 | No fix listed |
| plone cmfeditions | = 2.0a1 | No fix listed |
| plone cmfeditions | = 2.0b1 | No fix listed |
| plone cmfeditions | = 2.0b2 | No fix listed |
| plone cmfeditions | = 2.0b3 | No fix listed |
| plone cmfeditions | = 2.0b4 | No fix listed |
| plone cmfeditions | = 2.0b5 | No fix listed |
| plone cmfeditions | = 2.0b6 | No fix listed |
| plone cmfeditions | = 2.0b7 | No fix listed |
| plone cmfeditions | = 2.0b8 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| plone cmfeditions | = 2.0b9 | No fix listed |
| plone | = 4.0 | No fix listed |
| plone | = 4.0.1 | No fix listed |
| plone | = 4.0.2 | No fix listed |
| plone | = 4.0.3 | No fix listed |
| plone | = 4.0.4 | No fix listed |
| plone | = 4.0.5 | No fix listed |
| plone | = 4.0.6.1 | No fix listed |
| plone | = 4.0.7 | No fix listed |
| plone | = 4.0.8 | No fix listed |
| plone | = 4.0.9 | No fix listed |
| plone | = 4.1 | No fix listed |
| plone | = 4.2 | No fix listed |
| plone | = 4.2a1 | No fix listed |
| plone | = 4.2a2 | No fix listed |
| pypi plone(PyPI) | >= 4.0, <= 4.0.9 | No fix listed |
| pypi plone(PyPI) | >= 4.2a1, <= 4.2a2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- plone.org patch
- plone.org patch
- pypi.python.org patch
- pypi.org product
- github.com vendor-advisory
- 46323 third-party-advisory
- 50287 vdb-entry