CVE-2016-4041

Advisory

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.


MLIST:[oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone: http://www.openwall.com/lists/oss-security/2016/04/20/1
CONFIRM:https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav: https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4041
• https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav
• http://www.openwall.com/lists/oss-security/2016/04/20/1