CVE-2012-5501: High severity plone cms vulnerability

Q: What is the severity of CVE-2012-5501?

CVE-2012-5501 is considered to be of medium severity due to its impact on data confidentiality.

Q: How do I fix CVE-2012-5501?

To fix CVE-2012-5501, upgrade to Plone version 4.2.3 or 4.3 beta 1 or later.

Q: What platforms are affected by CVE-2012-5501?

CVE-2012-5501 affects Plone versions prior to 4.2.3 and 4.3 before beta 1.

Q: What types of data can be accessed due to CVE-2012-5501?

CVE-2012-5501 allows remote attackers to read arbitrary BLOBs, including files and images.

Q: Is there a workaround for CVE-2012-5501?

There is no known workaround for CVE-2012-5501, so upgrading is the recommended solution.

Published Sep 30, 2014

Updated

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

Other sources

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

Affected Software

75 affected componentsFixes available

pip/plone>=4.3a1<4.3b1

4.3b1

pip/plone<4.2.3

4.2.3

pip/Plone>=4.3a0<4.3b1

4.3b1

Plone plone<=4.2.2

Plone plone=1.0

Plone plone=1.0.1

Plone plone=1.0.2

Plone plone=1.0.3

Plone plone=1.0.4

Plone plone=1.0.5

Plone plone=1.0.6

Plone plone=2.0

Plone plone=2.0.1

Plone plone=2.0.2

Plone plone=2.0.3

Plone plone=2.0.4

Plone plone=2.0.5

Plone plone=2.1

Plone plone=2.1.1

Plone plone=2.1.2

Plone plone=2.1.3

Plone plone=2.1.4

Plone plone=2.5

Plone plone=2.5.1

Plone plone=2.5.2

Plone plone=2.5.3

Plone plone=2.5.4

Plone plone=2.5.5

Plone plone=3.0

Plone plone=3.0.1

Plone plone=3.0.2

Plone plone=3.0.3

Plone plone=3.0.4

Plone plone=3.0.5

Plone plone=3.0.6

Plone plone=3.1

Plone plone=3.1.1

Plone plone=3.1.2

Plone plone=3.1.3

Plone plone=3.1.4

Plone plone=3.1.5.1

Plone plone=3.1.6

Plone plone=3.1.7

Plone plone=3.2

Plone plone=3.2.1

Plone plone=3.2.2

Plone plone=3.2.3

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.6.1

Plone plone=4.1

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2-a1

Plone plone=4.2-a2

Plone plone=4.2-b1

Plone plone=4.2-b2

Plone plone=4.2-rc1

Plone plone=4.2-rc2

Plone plone=4.2.0.1

Plone plone=4.2.1

Plone plone=4.2.1.1

Plone plone=4.3

Remediation

Patch Available

https://plone.org/products/plone-hotfix/releases/20121106

Event History

Sep 30, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

May 17, 2022

Advisory Published

04:32 AM

Frequently Asked Questions

What is the severity of CVE-2012-5501?