CVE-2011-4030

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0	Patch
http://plone.org/products/plone-hotfix/releases/20110928	Patch
http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip	Patch
http://secunia.com/advisories/46323
http://www.securityfocus.com/bid/50287

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:plone:cmfeditions:2.0b6:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b7:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b8:::::::*
	cpe:2.3:a:plone:plone:4.0.4:::::::*
	cpe:2.3:a:plone:plone:4.0.6.1:::::::*
	cpe:2.3:a:plone:plone:4.2a1:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0a1:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b1:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b9:::::::*
	cpe:2.3:a:plone:plone:4.0.1:::::::*
	cpe:2.3:a:plone:plone:4.0.7:::::::*
	cpe:2.3:a:plone:plone:4.0.5:::::::*
	cpe:2.3:a:plone:plone:4.0.2:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b5:::::::*
	cpe:2.3:a:plone:plone:4.0.8:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b3:::::::*
	cpe:2.3:a:plone:plone:4.0.9:::::::*
	cpe:2.3:a:plone:plone:4.1:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b2:::::::*
	cpe:2.3:a:plone:plone:4.0:::::::*
	cpe:2.3:a:plone:plone:4.0.3:::::::*
	cpe:2.3:a:plone:plone:4.2a2:::::::*
	cpe:2.3:a:plone:cmfeditions:2.0b4:::::::*
	cpe:2.3:a:plone:plone:4.2:::::::*

Information

Published : 2011-10-10 03:55

Updated : 2011-10-29 20:39

NVD link : CVE-2011-4030

Mitre link : CVE-2011-4030

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

plone

cmfeditions
plone

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0", "name": "http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://plone.org/products/plone-hotfix/releases/20110928", "name": "http://plone.org/products/plone-hotfix/releases/20110928", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip", "name": "http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/46323", "name": "46323", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/50287", "name": "50287", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-4030", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2011-10-10T10:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.2a1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0a1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.2a2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:cmfeditions:2.0b4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-10-30T03:39Z"}