CVE-2012-5488: Code Injection
A security flaw was found in the way Plone, a user friendly and powerful content management system, performed protection of privilege to run RestrictedPython scripts. A remote attacker could provide a specially-crafted URL that, when processed, would allow the attacker to submit and perform excessively expensive computations or (in conjuction with other attacks) to access or alter privileged information.
References: [1] http://plone.org/products/plone/security/advisories/20121106/04 [2] http://plone.org/products/plone/security/advisories/20121106/
Relevant upstream HotFixes: [3] http://plone.org/products/plone-hotfix/releases/20121106
From the OSS post: [4] http://www.openwall.com/lists/oss-security/2012/11/07/4
the pythonscripts.py createObject() change from upstream HotFix is relevant to this issue.
Other sources
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5488?
CVE-2012-5488 has been assigned a severity of medium due to the potential for a remote attacker to execute arbitrary code.
How do I fix CVE-2012-5488?
To fix CVE-2012-5488, upgrade Plone to version 4.2.3 or later, or apply the relevant patches if available.
Which versions of Plone are affected by CVE-2012-5488?
CVE-2012-5488 affects Plone versions up to and including 4.2.2 and earlier versions.
Can CVE-2012-5488 be exploited remotely?
Yes, CVE-2012-5488 can be exploited remotely through a specially-crafted URL.
What type of vulnerability is CVE-2012-5488 categorized as?
CVE-2012-5488 is categorized as a remote code execution vulnerability.