There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products,
    allows remote attackers to obtain administrative access, read or create arbitrary content, and change the
    site skin via unknown vectors. (CVE-2011-0720)

The conga packages provide a web-based administration tool for remote cluster and storage management.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

Users of Conga are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, luci must be restarted ('service luci restart') for the update to take effect.

SL 4x

Updated conga packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The conga packages provide a web-based administration tool for remote cluster and storage management.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

Users of Conga are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, luci must be restarted ('service luci restart') for the update to take effect.

Plone developer reports :

This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still in place, and it does not grant access to other applications running on the same Zope instance.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products,     allows remote attackers to obtain administrative access, read or create arbitrary content, and change the     site skin via unknown vectors. (CVE-2011-0720)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Plone on the remote host fails to require authentication to access several sensitive functions.

Plone is built on top of Zope, which maps Python objects and their methods to URLs.  Methods can have security restrictions, such as requiring a login account or a specific privilege level, applied to them to limit access.  The installed version of Plone permits access to several methods that allow the adding, deleting, and changing content and users.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0394 advisory.

    The conga packages provide a web-based administration tool for remote     cluster and storage management.

    A privilege escalation flaw was found in luci, the Conga web-based     administration application. A remote attacker could possibly use this flaw     to obtain administrative access, allowing them to read, create, or modify     the content of the luci application. (CVE-2011-0720)

    Users of Conga are advised to upgrade to these updated packages, which     contain a backported patch to resolve this issue. After installing the     updated packages, luci must be restarted (service luci restart) for the     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Plone installed on the remote host is prior to 2.5.5, 3.x prior to 3.3.6, or 4.x prior to 4.0.4. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain administrative access to the application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20110720) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0394 advisory.

    [0.12.2-24.0.1.el5_6.1]
    - Added conga-enterprise.patch
    - Added conga-enterprise-Carthage.patch to support OEL5
    - Recreated Data.fs  in luci_db.tar.gz
    - Replaced redhat logo image in conga-0.12.2.tar.gz

    [0.12.2-24.1]
    - Fix bz680515 (CVE-2011-0720 plone: unauthorized remote administrative access)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
434424	SCA: security update for Plone (GHSA-3v28-9jjp-4g5w)	Tenable Cloud Security	SCA Checks	8/19/2025	7/2/2026	critical
434424	SCA: security update for Plone (GHSA-3v28-9jjp-4g5w)	Tenable Self-Hosted Container Security	SCA Checks	8/19/2025	7/2/2026	critical
60996	Scientific Linux Security Update : conga on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
53504	CentOS 5 : conga (CESA-2011:0394)	Nessus	CentOS Local Security Checks	4/21/2011	1/4/2021	high
56079	FreeBSD : plone -- Remote Security Bypass (7c492ea2-3566-11e0-8e81-0022190034c0)	Nessus	FreeBSD Local Security Checks	9/6/2011	1/6/2021	high
60997	Scientific Linux Security Update : conga on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
217390	Linux Distros Unpatched Vulnerability : CVE-2011-0720	Nessus	Misc.	3/3/2025	1/28/2026	critical
53546	Plone Security Bypass	Nessus	CGI abuses	4/25/2011	1/30/2026	critical
63975	RHEL 5 : conga (RHSA-2011:0394)	Nessus	Red Hat Local Security Checks	1/24/2013	3/24/2025	high
329012	Plone < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 Privilege Escalation (HF 20110720)	Nessus	Misc.	7/22/2026	7/23/2026	critical
68240	Oracle Linux 5 : conga (ELSA-2011-0394)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	high

Detections

Analytics

Plugins Search

critical

critical

high

high

high

high

critical

critical

high

critical

high