| Vulnerability Name: | CVE-2012-5491 (CCN-102850) |
| Assigned: | 2012-10-30 |
| Published: | 2012-10-30 |
| Updated: | 2014-10-01 |
| Summary: | z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): None
Availibility (A): None |
|
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
|
| Vulnerability Type: | CWE-200
|
| Vulnerability Consequences: | Obtain Information |
| References: | Source: MITRE
Type: CNA
CVE-2012-5491
Source: CCN
Type: oss-security Mailing List, Fri, 09 Nov 2012 22:47:49 -0700
Zope / Plone: Multiple vectors corrected within 20121106 fix
Source: MLIST
Type: UNKNOWN
[oss-security] 20121109 Re: Re: CVE Request - Zope / Plone: Multiple vectors corrected within 20121106 fix
Source: XF
Type: UNKNOWN
plone-cve20125491-info-disc(102850)
Source: CONFIRM
Type: UNKNOWN
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
Source: CONFIRM
Type: Patch
https://plone.org/products/plone-hotfix/releases/20121106
Source: CCN
Type: Plone Security Advisory
Form detail exposure
Source: CONFIRM
Type: Vendor Advisory
https://plone.org/products/plone/security/advisories/20121106/07
Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2012-5491
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:plone:plone:1.0:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:1.0.6:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.0.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.1.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.1.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.1.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.1.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:2.5.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.0.6:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.5.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.6:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.1.7:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.2.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.2.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.2.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:3.3.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.3:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.0.6.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.1.4:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.1.5:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.1.6:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:a1:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:a2:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:b1:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:b2:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:rc1:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2:rc2:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2.0.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:4.2.1.1:*:*:*:*:*:*:*OR cpe:/a:plone:plone:*:*:*:*:*:*:*:* (Version <= 4.2.2)OR cpe:/a:plone:plone:4.3:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:plone:plone:4.2:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |