CVE-2012-5493: Code Injection

Q: What is the severity of CVE-2012-5493?

CVE-2012-5493 is considered a medium severity vulnerability due to its capability of allowing remote authenticated users to bypass the Python sandbox.

Q: How do I fix CVE-2012-5493?

To fix CVE-2012-5493, upgrade to Plone version 4.2.3 or 4.3-beta1 or later.

Q: What versions of Plone are affected by CVE-2012-5493?

CVE-2012-5493 affects Plone versions before 4.2.3 and all versions of 4.3 prior to beta 1.

Q: Who can exploit CVE-2012-5493?

CVE-2012-5493 can be exploited by remote authenticated users with specific permissions.

Q: What type of vulnerability is CVE-2012-5493?

CVE-2012-5493 is a remote code execution vulnerability that allows the execution of arbitrary Python code.

Published Sep 30, 2014

Updated

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

Other sources

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

Affected Software

74 affected componentsFixes available

pip/Plone>=4.3a0<4.3b1

4.3b1

pip/plone<4.2.3

4.2.3

Plone plone<=4.2.2

Plone plone=1.0

Plone plone=1.0.1

Plone plone=1.0.2

Plone plone=1.0.3

Plone plone=1.0.4

Plone plone=1.0.5

Plone plone=1.0.6

Plone plone=2.0

Plone plone=2.0.1

Plone plone=2.0.2

Plone plone=2.0.3

Plone plone=2.0.4

Plone plone=2.0.5

Plone plone=2.1

Plone plone=2.1.1

Plone plone=2.1.2

Plone plone=2.1.3

Plone plone=2.1.4

Plone plone=2.5

Plone plone=2.5.1

Plone plone=2.5.2

Plone plone=2.5.3

Plone plone=2.5.4

Plone plone=2.5.5

Plone plone=3.0

Plone plone=3.0.1

Plone plone=3.0.2

Plone plone=3.0.3

Plone plone=3.0.4

Plone plone=3.0.5

Plone plone=3.0.6

Plone plone=3.1

Plone plone=3.1.1

Plone plone=3.1.2

Plone plone=3.1.3

Plone plone=3.1.4

Plone plone=3.1.5.1

Plone plone=3.1.6

Plone plone=3.1.7

Plone plone=3.2

Plone plone=3.2.1

Plone plone=3.2.2

Plone plone=3.2.3

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.6.1

Plone plone=4.1

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2-a1

Plone plone=4.2-a2

Plone plone=4.2-b1

Plone plone=4.2-b2

Plone plone=4.2-rc1

Plone plone=4.2-rc2

Plone plone=4.2.0.1

Plone plone=4.2.1

Plone plone=4.2.1.1

Plone plone=4.3

Remediation

Patch Available

https://plone.org/products/plone-hotfix/releases/20121106

Event History

Sep 30, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

May 17, 2022

Advisory Published

04:32 AM

Frequently Asked Questions

What is the severity of CVE-2012-5493?