Description
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Cluster 5 | luci +2 | 0.12.2-24.el5_6.1 | RHSA-2011:0394 |
| Red Hat Rhel Cluster 4 | luci +2 | 0.11.2-4.el4.2 | RHSA-2011:0393 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 2.5, < 4.0.4 | 4.0.4 | GHSA-3v28-9jjp-4g5w |
| PyPI | plone | < 4.0.1 | 4.0.1 | PYSEC-2011-13 |
Advisories 2
- RHSA-2011:0394 Red Hat Security Advisory: conga security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0393 Red Hat Security Advisory: conga security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 70753 vdb-entry
- http://plone.org/products/plone/security/advisories/cve-2011-0720
- 46102 vdb-entry
- 43146 third-party-advisory
- RHSA-2011:0393 vendor-advisory
- plone-unspec-priv-escalation(65099) vdb-entry
- ADV-2011-0796 vdb-entry
- 43914 third-party-advisory
- 1025258 vdb-entry
- RHSA-2011:0394 vendor-advisory