CVE-2012-5485: Code Injection
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
Other sources
A security flaw was found in the way Plone, a user friendly and powerful content management system based on Zope, performed execution of restricted Python statements, when the administrator interface / control panel was accessed. A remote attacker could inject specially-crafted Python statement / script into the Plone's restricted Python sandbox that, when the administrator interface was accessed would be executed with the privileges of that admin user.
References: [1] http://plone.org/products/plone/security/advisories/20121106/01 [2] http://plone.org/products/plone/security/advisories/20121106/
Relevant upstream HotFixes: [3] http://plone.org/products/plone-hotfix/releases/20121106
From the OSS post: [4] http://www.openwall.com/lists/oss-security/2012/11/07/4
the registerConfiglet.py change from upstream HotFix is relevant to this issue.
— Red Hat
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5485?
CVE-2012-5485 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2012-5485?
To fix CVE-2012-5485, upgrade Plone to version 4.2.3 or 4.3 beta 1.
What versions of Plone are affected by CVE-2012-5485?
Versions of Plone before 4.2.3 and 4.3 up to beta 1 are affected by CVE-2012-5485.
What type of vulnerability is CVE-2012-5485?
CVE-2012-5485 is a remote code execution vulnerability.
Is CVE-2012-5485 exploitable from the internet?
Yes, CVE-2012-5485 can be exploited remotely, allowing attackers to execute arbitrary Python code through the admin interface.