CVE-2012-5489: Medium severity plone cms vulnerability

Q: What is the severity of CVE-2012-5489?

CVE-2012-5489 has been classified as a moderate severity vulnerability that allows remote authenticated users to access restricted attributes.

Q: How do I fix CVE-2012-5489?

To fix CVE-2012-5489, upgrade to Plone version 4.2.3 or later, or Zope version 2.13.11 or later.

Q: Which versions of Plone are affected by CVE-2012-5489?

All versions of Plone before 4.2.3, as well as various 4.3 beta versions, are affected by CVE-2012-5489.

Q: How does CVE-2012-5489 affect Zope?

CVE-2012-5489 affects Zope versions before 2.12.21 and 3.13.x before 2.13.11, allowing unauthorized access to certain attributes.

Q: Can CVE-2012-5489 be exploited remotely?

Yes, CVE-2012-5489 can be exploited remotely by authenticated users to gain access to restricted attributes.

Published Sep 30, 2014

Updated

The App.Undo.UndoSupport.getrequestvarorattr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Affected Software

113 affected componentsFixes available

pip/Plone>=4.3a1<=4.3a2

4.3b1

pip/Plone>=3.2.2<4.2.3

4.2.3

pip/Zope2>=2.13.0<2.13.11

2.13.11

pip/Zope2<2.12.21

2.12.21

Plone plone<=4.2.2

Plone plone=1.0

Plone plone=1.0.1

Plone plone=1.0.2

Plone plone=1.0.3

Plone plone=1.0.4

Plone plone=1.0.5

Plone plone=1.0.6

Plone plone=2.0

Plone plone=2.0.1

Plone plone=2.0.2

Plone plone=2.0.3

Plone plone=2.0.4

Plone plone=2.0.5

Plone plone=2.1

Plone plone=2.1.1

Plone plone=2.1.2

Plone plone=2.1.3

Plone plone=2.1.4

Plone plone=2.5

Plone plone=2.5.1

Plone plone=2.5.2

Plone plone=2.5.3

Plone plone=2.5.4

Plone plone=2.5.5

Plone plone=3.0

Plone plone=3.0.1

Plone plone=3.0.2

Plone plone=3.0.3

Plone plone=3.0.4

Plone plone=3.0.5

Plone plone=3.0.6

Plone plone=3.1

Plone plone=3.1.1

Plone plone=3.1.2

Plone plone=3.1.3

Plone plone=3.1.4

Plone plone=3.1.5.1

Plone plone=3.1.6

Plone plone=3.1.7

Plone plone=3.2

Plone plone=3.2.1

Plone plone=3.2.2

Plone plone=3.2.3

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.6.1

Plone plone=4.1

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2-a1

Plone plone=4.2-a2

Plone plone=4.2-b1

Plone plone=4.2-b2

Plone plone=4.2-rc1

Plone plone=4.2-rc2

Plone plone=4.2.0.1

Plone plone=4.2.1

Plone plone=4.2.1.1

Plone plone=4.3

Zope Zope<=2.13.10

Zope Zope=2.5.1

Zope Zope=2.6.1

Zope Zope=2.6.4

Zope Zope=2.7.0

Zope Zope=2.7.3

Zope Zope=2.7.4

Zope Zope=2.7.5

Zope Zope=2.7.6

Zope Zope=2.7.7

Zope Zope=2.7.8

Zope Zope=2.8.1

Zope Zope=2.8.4

Zope Zope=2.8.6

Zope Zope=2.8.8

Zope Zope=2.9.2

Zope Zope=2.9.3

Zope Zope=2.9.4

Zope Zope=2.9.5

Zope Zope=2.9.6

Zope Zope=2.9.7

Zope Zope=2.10.3

Zope Zope=2.10.8

Zope Zope=2.11.0

Zope Zope=2.11.1

Zope Zope=2.11.2

Zope Zope=2.11.3

Zope Zope=2.13.0

Zope Zope=2.13.1

Zope Zope=2.13.2

Zope Zope=2.13.3

Zope Zope=2.13.4

Zope Zope=2.13.5

Zope Zope=2.13.6

Zope Zope=2.13.7

Zope Zope=2.13.8

Zope Zope=2.13.9

Remediation

Patch Available

https://plone.org/products/plone-hotfix/releases/20121106

Event History

Sep 30, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Jul 23, 2018

Advisory Published

via GitHub·07:52 PM

Frequently Asked Questions

What is the severity of CVE-2012-5489?

CVE-2012-5489 has been classified as a moderate severity vulnerability that allows remote authenticated users to access restricted attributes.

How do I fix CVE-2012-5489?

To fix CVE-2012-5489, upgrade to Plone version 4.2.3 or later, or Zope version 2.13.11 or later.

Which versions of Plone are affected by CVE-2012-5489?