Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote
    administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to
    Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. (CVE-2016-7135)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote     administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to     Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. (CVE-2016-7135)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
434181	SCA: security update for Plone (GHSA-m7f9-65wr-pwch)	Tenable Cloud Security	SCA Checks	medium
434181	SCA: security update for Plone (GHSA-m7f9-65wr-pwch)	Tenable Self-Hosted Container Security	SCA Checks	medium
219847	Linux Distros Unpatched Vulnerability : CVE-2016-7135	Nessus	Misc.	medium

Detections

Analytics

CVE-2016-7135

medium

Tenable Plugins

medium

medium

medium