CVE-2020-7941

Advisory

Plone-app-contenttypes version 2.1.6 includes a fix for CVE-2020-7941: A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

Bug fixes:


- Integrate PloneHotFix20200121: add more permission checks.
See https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content
[maurits] (3021)
- Add a guard in the document.pt template to allow the Document type not to have the RichText
enforce the behavior enabled.
[sneridagh] (3047)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7941
• https://plone.org/security/hotfix/20200121
• https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content
• https://www.openwall.com/lists/oss-security/2020/01/22/1
• http://www.openwall.com/lists/oss-security/2020/01/24/1