The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities:

  - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors,     related to the admin interface. (CVE-2012-5485)

  - ZPublisher.HTTPRequest._scrubHeader in Zope 2, as used in Plone, allows remote attackers to inject     arbitrary HTTP headers via a linefeed (LF) character. (CVE-2012-5486)

  - The sandbox whitelisting function (allowmodule.py) in Plone allows remote authenticated users with certain     privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related     to importing. (CVE-2012-5487)

  - python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to     createObject. (CVE-2012-5488)

  - The App.Undo.UndoSupport.get_request_var_or_attr function in Zope, as used in Plone, allows remote     authenticated users to gain access to restricted attributes via unspecified vectors. (CVE-2012-5489)

  - Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone allows remote attackers to inject     arbitrary web script or HTML via unspecified vectors. (CVE-2012-5490)

  - z3c.form, as used in Plone, allows remote attackers to obtain the default form field values by leveraging     knowledge of the form location and the element id. (CVE-2012-5491)

  - uid_catalog.py in Plone allows remote attackers to obtain metadata about hidden objects via a crafted URL.
    (CVE-2012-5492)

  - gtbn.py in Plone allows remote authenticated users with certain permissions to bypass the Python sandbox     and execute arbitrary Python code via unspecified vectors. (CVE-2012-5493)

  - Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone allows remote attackers to inject     arbitrary web script or HTML via unspecified vectors, related to '{u,}translate'. (CVE-2012-5494)

  - python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to     'go_back'. (CVE-2012-5495)

  - kupu_spellcheck.py in Kupu allows remote attackers to cause a denial of service (ZServer thread lock) via     a crafted URL. (CVE-2012-5496)

  - membership_tool.py in Plone allows remote attackers to enumerate user account names via a crafted URL.
    (CVE-2012-5497)

  - queryCatalog.py in Plone allows remote attackers to bypass caching and cause a denial of service via a     crafted request to a collection. (CVE-2012-5498)

  - python_scripts.py in Plone allows remote attackers to cause a denial of service (memory consumption) via a     large value, related to formatColumns. (CVE-2012-5499)

  - The batch id change script (renameObjectsByPaths.py) in Plone allows remote attackers to change the titles     of content items by leveraging a valid CSRF token in a crafted request. (CVE-2012-5500)

  - at_download.py in Plone allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom     content types via a crafted URL. (CVE-2012-5501)

  - Cross-site scripting (XSS) vulnerability in safe_html.py in Plone allows remote authenticated users with     permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
    (CVE-2012-5502)

  - ftp.py in Plone allows remote attackers to read hidden folder contents via unspecified vectors.
    (CVE-2012-5503)

  - Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone allows remote attackers to inject     arbitrary web script or HTML via unspecified vectors. (CVE-2012-5504)

  - atat.py in Plone allows remote attackers to read private data structures via a request for a view without     a name. (CVE-2012-5505)

  - python_scripts.py in Plone allows remote attackers to cause a denial of service (infinite loop) via an RSS     feed request for a folder the user does not have permission to access. (CVE-2012-5506)

  - AccessControl/AuthEncoding.py in Zope, as used in Plone, allows remote attackers to obtain passwords via     vectors involving timing discrepancies in password validation. (CVE-2012-5507)

  - The error pages in Plone allow remote attackers to obtain random numbers and derive the PRNG state for     password resets via unspecified vectors. (CVE-2012-5508)

  - Zope, as used in Plone, does not reseed the pseudo-random number generator (PRNG), which makes it easier     for remote attackers to guess the value via unspecified vectors. (CVE-2012-6661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20121106) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows
    remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute
    arbitrary Python code via vectors related to importing. (CVE-2012-5487)

ID	Name	Product	Family	Severity
329021	Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)	Nessus	Misc.	critical
433669	SCA: security update for Plone, plone (GHSA-9m4g-f42q-vrrh)	Tenable Cloud Security	SCA Checks	medium
433669	SCA: security update for Plone, plone (GHSA-9m4g-f42q-vrrh)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2012-5487

medium

Tenable Plugins

critical

medium

medium