CVE-2012-5485

Advisory

Plone 4.2.3 and 4.3b1 include a fix for CVE-2012-5485: registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.


MLIST:[oss-security] 20121109 Re: Re: CVE Request - Zope / Plone: Multiple vectors corrected within 20121106 fix: http://www.openwall.com/lists/oss-security/2012/11/10/1
CONFIRM:https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt: https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
CONFIRM:https://plone.org/products/plone-hotfix/releases/20121106: https://plone.org/products/plone-hotfix/releases/20121106
CONFIRM:https://plone.org/products/plone/security/advisories/20121106/01: https://plone.org/products/plone/security/advisories/20121106/01
REDHAT:RHSA-2014:1194: http://rhn.redhat.com/errata/RHSA-2014-1194.html

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5485
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
• https://plone.org/products/plone-hotfix/releases/20121106
• http://www.openwall.com/lists/oss-security/2012/11/10/1
• https://plone.org/products/plone/security/advisories/20121106/01
• http://rhn.redhat.com/errata/RHSA-2014-1194.html