Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

The version of Plone installed on the remote host is less than or equal to 4.1.3. It is, therefore, affected by a denial of service vulnerability due to improper handling of hash values for form parameters to prevent hash collisions. An unauthenticated, remote attacker can exploit this issue, via specially crafted requests, to cause the application to stop responding.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to
    trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU
    consumption) by sending many crafted parameters. (CVE-2011-4462)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to     trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU     consumption) by sending many crafted parameters. (CVE-2011-4462)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
329010	Plone <= 4.1.3 DoS	Nessus	Misc.	Local	high
421903	SCA: security update for Plone (GHSA-pcwm-8jc3-qxvj)	Tenable Cloud Security	SCA Checks	Local	high
421903	SCA: security update for Plone (GHSA-pcwm-8jc3-qxvj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
217466	Linux Distros Unpatched Vulnerability : CVE-2011-4462	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2011-4462

high

Tenable Plugins

high

high

high

high