The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7. As a workaround, a site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities:

  - Plone CMS has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file     upload functionality. (CVE-2021-3313)

  - Products.PluggableAuthService within Zope has an information disclosure vulnerability - everyone can list the names of     roles defined in the ZODB Role Manager plugin if the site uses this plugin. (CVE-2021-21336)

  - Products.GenericSetup within Zope has an information disclosure vulnerability - anonymous visitors may     view log and snapshot files generated by the Generic Setup Tool. (CVE-2021-21360)

  - Zope has a remote code execution vulnerability via a traversal in the TAL expressions. (CVE-2021-32633,     CVE-2021-32674)

  - The AccessControl module within Zope has a remote code execution via the use of unsafe classes in     permitted modules. (CVE-2021-32807)

  - Zope Products.CMFCore and Products.PluggableAuthService, as used in Plone and other products, allow     Reflected XSS. (CVE-2021-33507)

  - Plone allows XSS via a full name that is mishandled during rendering of the ownership tab of a content     item. (CVE-2021-33508)

  - Plone allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the     ReStructuredText transform in a Python script. (CVE-2021-33509)

  - Plone allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line     of a file. (CVE-2021-33510)

  - Plone allows SSRF via the lxml parser. (CVE-2021-33511)

  - Plone allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. (CVE-2021-33512)

  - Plone allows XSS via the inline_diff methods in Products.CMFDiffTool. (CVE-2021-33513)

  - An issue in Plone CMS allows an attacker to access sensitive information via the RSS feed portlet.
    (CVE-2021-33926)

  - In Plone, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag     in the description field (CVE-2021-35959)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20210518) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The module `AccessControl` defines security policies for Python code used in restricted code within Zope
    applications. Restricted code is any code that resides in Zope's object database, such as the contents of
    `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python
    modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access
    to the `string` module also allows access to the class `Formatter`, which can be overridden and extended
    within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe
    Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope
    "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted
    users to add/edit these scripts through the web - which would be a very unusual configuration to begin
    with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4
    and 5 are vulnerable, and only on Python 3, not Python 2.7. As a workaround, a site administrator can
    restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role
    permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing
    these scripts through the web should be restricted to trusted users only. This is the default
    configuration in Zope. (CVE-2021-32807)

ID	Name	Product	Family	Severity
329024	Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)	Nessus	Misc.	critical
418074	SCA: security update for AccessControl, zope (GHSA-qcx9-j53g-ccgf)	Tenable Cloud Security	SCA Checks	medium
418074	SCA: security update for AccessControl, zope (GHSA-qcx9-j53g-ccgf)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2021-32807

medium

Tenable Plugins

critical

medium

medium