Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

The version of Plone installed on the remote host is 2.5.x prior to 2.5.5 or 3.0.x prior to 3.0.3. It is, therefore, affected by a remote code execution vulnerability in the statusmessages and linkintegrity modules. A unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary Python code. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20071106) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via
    network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the
    module unpickles and executes. (CVE-2007-5741)

Plone projectreports :

This hotfix corrects a vulnerability in the statusmessages and linkintegrity modules, where unsafe network data was interpreted as python pickles. This allows an attacker to run arbitrary python code within the Zope/Plone process.

It was discovered that Plone, a web content management system, allows remote attackers to execute arbitrary code via specially crafted web browser cookies.

The oldstable distribution (sarge) is not affected by this problem.

ID	Name	Product	Family	Type	Severity
329031	Plone 2.5.x < 2.5.5 / 3.0.x < 3.0.3 RCE (HF 20071106)	Nessus	Misc.	Local	critical
434198	SCA: security update for plone (GHSA-hf26-vvmx-x8c8)	Tenable Cloud Security	SCA Checks	Local	critical
434198	SCA: security update for plone (GHSA-hf26-vvmx-x8c8)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
28167	FreeBSD : plone -- unsafe data interpreted as pickles (ffba6ab0-90b5-11dc-9835-003048705d5a)	Nessus	FreeBSD Local Security Checks	Local	high
28150	Debian DSA-1405-3 : zope-cmfplone - missing input sanitising	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2007-5741

critical

Tenable Plugins

critical

critical

critical

high

high