Skip to content
OpenAdvisories
Medium · 4.9 CVE-2013-7061 EUVD-2014-0084GHSA-4vr8-r7qr-fpvqPYSEC-2014-66PYSEC-2014-68

Plone Privilege escalation through exposed underlying API

Published May 2, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Package: plone Package: products-cmfplone Ecosystem: PyPI

Description

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI plone >= 3.3b1, < 4.3.3 4.3.3 GHSA-4vr8-r7qr-fpvq
PyPI plone >= 3.3, < 4.3.3 4.3.3 PYSEC-2014-66
PyPI products-cmfplone >= 3.3, < 4.3.3 4.3.3 GHSA-4vr8-r7qr-fpvq

References