CVE-2024-23756: High severity Plone plone vulnerability
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Plone official Dockerto a version that resolves this vulnerability.Fixed in 5.2.13Patch 5221 - Configuration
Disable the HTTP PUT and DELETE methods in the Plone Docker deployment to prevent unauthenticated attackers from uploading or deleting resources.
Plone (HTTP methods) HTTP PUT and DELETE methods = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23756?
CVE-2024-23756 is considered a critical vulnerability due to the potential for unauthenticated attackers to upload or delete files on the server.
How do I fix CVE-2024-23756?
To fix CVE-2024-23756, disable the HTTP PUT and DELETE methods in your Plone configuration or update to a patched version.
Which versions of Plone are affected by CVE-2024-23756?
CVE-2024-23756 affects Plone version 5.2.13.
What actions can attackers perform due to CVE-2024-23756?
Attackers can upload and delete files on the server as a result of CVE-2024-23756.
Is user authentication required to exploit CVE-2024-23756?
No, CVE-2024-23756 allows unauthenticated attackers to exploit the vulnerability.