Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)

critical Nessus Plugin ID 329021

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities:

- registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. (CVE-2012-5485)

- ZPublisher.HTTPRequest._scrubHeader in Zope 2, as used in Plone, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. (CVE-2012-5486)

- The sandbox whitelisting function (allowmodule.py) in Plone allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing. (CVE-2012-5487)

- python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to createObject. (CVE-2012-5488)

- The App.Undo.UndoSupport.get_request_var_or_attr function in Zope, as used in Plone, allows remote authenticated users to gain access to restricted attributes via unspecified vectors. (CVE-2012-5489)

- Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2012-5490)

- z3c.form, as used in Plone, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id. (CVE-2012-5491)

- uid_catalog.py in Plone allows remote attackers to obtain metadata about hidden objects via a crafted URL.
(CVE-2012-5492)

- gtbn.py in Plone allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors. (CVE-2012-5493)

- Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to '{u,}translate'. (CVE-2012-5494)

- python_scripts.py in Plone allows remote attackers to execute Python code via a crafted URL, related to 'go_back'. (CVE-2012-5495)

- kupu_spellcheck.py in Kupu allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL. (CVE-2012-5496)

- membership_tool.py in Plone allows remote attackers to enumerate user account names via a crafted URL.
(CVE-2012-5497)

- queryCatalog.py in Plone allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection. (CVE-2012-5498)

- python_scripts.py in Plone allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns. (CVE-2012-5499)

- The batch id change script (renameObjectsByPaths.py) in Plone allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request. (CVE-2012-5500)

- at_download.py in Plone allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL. (CVE-2012-5501)

- Cross-site scripting (XSS) vulnerability in safe_html.py in Plone allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
(CVE-2012-5502)

- ftp.py in Plone allows remote attackers to read hidden folder contents via unspecified vectors.
(CVE-2012-5503)

- Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2012-5504)

- atat.py in Plone allows remote attackers to read private data structures via a request for a view without a name. (CVE-2012-5505)

- python_scripts.py in Plone allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access. (CVE-2012-5506)

- AccessControl/AuthEncoding.py in Zope, as used in Plone, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation. (CVE-2012-5507)

- The error pages in Plone allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. (CVE-2012-5508)

- Zope, as used in Plone, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. (CVE-2012-6661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20121106) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

Solution

Apply the vendor hotfix (Products.PloneHotfix20121106), or upgrade to Plone version 4.2.3 or later.

Plugin Details

Severity: Critical

ID: 329021

File Name: plone_HF_20121106.nasl

Version: 1.2

Type: Local

Family: Misc.

Published: 7/22/2026

Updated: 7/23/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2012-5493

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:plone:plone

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/6/2012

Vulnerability Publication Date: 11/6/2012

Reference Information

CVE: CVE-2012-5485, CVE-2012-5486, CVE-2012-5487, CVE-2012-5488, CVE-2012-5489, CVE-2012-5490, CVE-2012-5491, CVE-2012-5492, CVE-2012-5493, CVE-2012-5494, CVE-2012-5495, CVE-2012-5496, CVE-2012-5497, CVE-2012-5498, CVE-2012-5499, CVE-2012-5500, CVE-2012-5501, CVE-2012-5502, CVE-2012-5503, CVE-2012-5504, CVE-2012-5505, CVE-2012-5506, CVE-2012-5507, CVE-2012-5508, CVE-2012-6661

Detections

Analytics