~ / search / GHSA-pwpq-632g-h49g

GHSA-pwpq-632g-h49g

Plone Privilege escalation due improper authorization

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-4189

Packages

EcosystemPackageAffectedFixed in
PyPI Plone >= 2.1, <= 4.1 no fix listed
PyPI Plone >= 4.2, < 4.2.6 4.2.6
PyPI Plone >= 4.3, < 4.3.2 4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple unspecified vulnerabilities in (1) `dataitems.py`, (2) `get.py`, and (3) `traverseName.py` in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.

References

External links from the advisory. They lead to third-party sites.