REDHAT-BUG-874681

First published: Thu Nov 08 2012(Updated: )

An information disclosure flaw was found in the way Plone, a user friendly and powerful content management system, enforced permissions check on membership database. A remote attacker could provide a specially-crafted URL that, when processed could allow the attacker to enumerate user account names. References: [1] <a href="http://plone.org/products/plone/security/advisories/20121106/13">http://plone.org/products/plone/security/advisories/20121106/13</a> [2] <a href="http://plone.org/products/plone/security/advisories/20121106/">http://plone.org/products/plone/security/advisories/20121106/</a> Relevant upstream HotFixes: [3] <a href="http://plone.org/products/plone-hotfix/releases/20121106">http://plone.org/products/plone-hotfix/releases/20121106</a> From the OSS post: [4] <a href="http://www.openwall.com/lists/oss-security/2012/11/07/4">http://www.openwall.com/lists/oss-security/2012/11/07/4</a> the membership_tool.py change from upstream HotFix is relevant to this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2012-5497
• agent/severity
• agent/description
• agent/event
• agent/source
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/plone
• canonical/plone cms