GHSA-pwgm-jvqv-6v8pHigh

Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

Published
May 17, 2022
Last Modified
November 22, 2024

🔗 CVE IDs covered (1)

CVE-2011-4030 →

📋 Description

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

🎯 Affected products3

  • pip/Plone:>= 4.0, <= 4.0.9
  • pip/Plone:>= 4.1, < 4.1.1
  • pip/Plone:>= 4.2a1, <= 4.2a2

🔗 References (6)