CVE-2011-4030: Critical severity plone cmfeditions vulnerability
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4030?
CVE-2011-4030 is classified as a moderate-severity vulnerability due to its potential to allow unauthorized access to sub-objects.
How do I fix CVE-2011-4030?
To fix CVE-2011-4030, upgrade to Plone version 4.2a3 or later, or apply the available hotfix.
What versions of Plone are affected by CVE-2011-4030?
CVE-2011-4030 affects Plone versions 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, along with certain versions of CMFEditions.
Is CVE-2011-4030 exploitable remotely?
Yes, CVE-2011-4030 can be exploited remotely, allowing attackers to access sensitive sub-objects.
What component is responsible for the vulnerability in CVE-2011-4030?
The vulnerability in CVE-2011-4030 is due to the CMFEditions component allowing KwAsAttributes classes to be publishable.