CVE-2012-5489
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
- zope:zope
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-879r-7f3w-8jj3 | PyPI | zope2 | <2.12.21 | 2.12.21 |
| GHSA-879r-7f3w-8jj3 | PyPI | zope2 | >=2.13.0 <2.13.11 | 2.13.11 |
| GHSA-879r-7f3w-8jj3 | PyPI | plone | >=3.2.2 <4.2.3 | 4.2.3 |
| GHSA-879r-7f3w-8jj3 | PyPI | plone | >=4.3a1 <4.3b1 | 4.3b1 |
| PYSEC-2014-31 | PyPI | plone | <4.2.3 >=4.3a0 <4.3b1 | 4.2.3, 4.3b1 |
| PYSEC-2014-74 | PyPI | zope2 | <2.12.21 >=2.13 <2.13.11 | 2.12.21, 2.13.11 |