CVE-2012-5491
MEDIUM5.3EPSS 0.32%Plone Information Disclosure
發布日:2022/5/17修改日:2024/10/14
描述
`z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
受影響套件(2)
- PyPI/plonefrom 0, < 4.2.3
- PyPI/plonefrom 0, < 4.2.3, >= 4.3a0, < 4.3b1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2012-5491
- PATCHhttps://github.com/plone/Plone
- WEBhttps://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-33.yaml
- WEBhttps://plone.org/products/plone-hotfix/releases/20121106
- WEBhttps://plone.org/products/plone/security/advisories/20121106/07
- WEBhttp://www.openwall.com/lists/oss-security/2012/11/10/1