CVE-2011-4030

Summary

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Impact & exploitability

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: http://plone.org/products/plone-hotfix/releases/20110928 ↗

Additional information

• NVD record
• http://plone.org/products/plone-hotfix/releases/20110928Patch
• http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zipPatch
• http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0Patch
• http://secunia.com/advisories/46323
• http://www.securityfocus.com/bid/50287