Vulnerability Name:

CVE-2012-5489 (CCN-102848)

Assigned:2012-10-30
Published:2012-10-30
Updated:2014-10-02
Summary:The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
3.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Informational
References:Source: MITRE
Type: CNA
CVE-2012-5489

Source: CCN
Type: oss-security Mailing List, Fri, 09 Nov 2012 22:47:49 -0700
Zope / Plone: Multiple vectors corrected within 20121106 fix

Source: MLIST
Type: UNKNOWN
[oss-security] 20121109 Re: Re: CVE Request - Zope / Plone: Multiple vectors corrected within 20121106 fix

Source: CONFIRM
Type: UNKNOWN
https://bugs.launchpad.net/zope2/+bug/1079238

Source: XF
Type: UNKNOWN
plone-cve20125489-unauth-access(102848)

Source: CONFIRM
Type: UNKNOWN
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt

Source: CONFIRM
Type: Patch
https://plone.org/products/plone-hotfix/releases/20121106

Source: CCN
Type: Plone Security Advisory
Partial restricted Python sandbox escape

Source: CONFIRM
Type: Vendor Advisory
https://plone.org/products/plone/security/advisories/20121106/05

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2012-5489

Vulnerable Configuration:Configuration 1:
  • cpe:/a:plone:plone:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:a1:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:a2:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:b1:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:b2:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2:rc2:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:*:*:*:*:*:*:*:* (Version <= 4.2.2)
  • OR cpe:/a:plone:plone:4.3:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/a:zope:zope:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.6:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.7:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.7.8:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.8.1:-:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.8.6:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.8.8:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.10.3:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.10.8:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.11.0:-:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.11.1:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.11.2:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.11.3:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.0:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.1:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.2:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.3:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.4:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.5:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.6:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.7:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.8:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:2.13.9:*:*:*:*:*:*:*
  • OR cpe:/a:zope:zope:*:*:*:*:*:*:*:* (Version <= 2.13.10)

  • Configuration CCN 1:
  • cpe:/a:plone:plone:4.2:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    plone plone 1.0
    plone plone 1.0.1
    plone plone 1.0.2
    plone plone 1.0.3
    plone plone 1.0.4
    plone plone 1.0.5
    plone plone 1.0.6
    plone plone 2.0
    plone plone 2.0.1
    plone plone 2.0.2
    plone plone 2.0.3
    plone plone 2.0.4
    plone plone 2.0.5
    plone plone 2.1
    plone plone 2.1.1
    plone plone 2.1.2
    plone plone 2.1.3
    plone plone 2.1.4
    plone plone 2.5
    plone plone 2.5.1
    plone plone 2.5.2
    plone plone 2.5.3
    plone plone 2.5.4
    plone plone 2.5.5
    plone plone 3.0
    plone plone 3.0.1
    plone plone 3.0.2
    plone plone 3.0.3
    plone plone 3.0.4
    plone plone 3.0.5
    plone plone 3.0.6
    plone plone 3.1
    plone plone 3.1.1
    plone plone 3.1.2
    plone plone 3.1.3
    plone plone 3.1.4
    plone plone 3.1.5.1
    plone plone 3.1.6
    plone plone 3.1.7
    plone plone 3.2
    plone plone 3.2.1
    plone plone 3.2.2
    plone plone 3.2.3
    plone plone 3.3
    plone plone 3.3.1
    plone plone 3.3.2
    plone plone 3.3.3
    plone plone 3.3.4
    plone plone 3.3.5
    plone plone 4.0
    plone plone 4.0.1
    plone plone 4.0.2
    plone plone 4.0.3
    plone plone 4.0.4
    plone plone 4.0.5
    plone plone 4.0.6.1
    plone plone 4.1
    plone plone 4.1.4
    plone plone 4.1.5
    plone plone 4.1.6
    plone plone 4.2
    plone plone 4.2 a1
    plone plone 4.2 a2
    plone plone 4.2 b1
    plone plone 4.2 b2
    plone plone 4.2 rc1
    plone plone 4.2 rc2
    plone plone 4.2.0.1
    plone plone 4.2.1
    plone plone 4.2.1.1
    plone plone *
    plone plone 4.3
    zope zope 2.5.1
    zope zope 2.6.1
    zope zope 2.6.4
    zope zope 2.7.0
    zope zope 2.7.3
    zope zope 2.7.4
    zope zope 2.7.5
    zope zope 2.7.6
    zope zope 2.7.7
    zope zope 2.7.8
    zope zope 2.8.1
    zope zope 2.8.4
    zope zope 2.8.6
    zope zope 2.8.8
    zope zope 2.9.2
    zope zope 2.9.3
    zope zope 2.9.4
    zope zope 2.9.5
    zope zope 2.9.6
    zope zope 2.9.7
    zope zope 2.10.3
    zope zope 2.10.8
    zope zope 2.11.0
    zope zope 2.11.1
    zope zope 2.11.2
    zope zope 2.11.3
    zope zope 2.13.0
    zope zope 2.13.1
    zope zope 2.13.2
    zope zope 2.13.3
    zope zope 2.13.4
    zope zope 2.13.5
    zope zope 2.13.6
    zope zope 2.13.7
    zope zope 2.13.8
    zope zope 2.13.9
    zope zope *
    plone plone 4.2