CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2020-7938
High (8.8) in plone plone. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in plone-restapi 6.2.1.
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cjg3-q24h-9qwf | PyPI | plone-restapi | <6.2.1 | 6.2.1 |
| GHSA-cjg3-q24h-9qwf | PyPI | plone | >=5.2.0 <5.2.2 | 5.2.2 |
| PYSEC-2020-87 | PyPI | plone | >=5.2.0 <5.2.2 | 5.2.2 |
| PYSEC-2026-2889 | PyPI | plone-restapi | <6.2.1 | 6.2.1 |
References
- http://www.openwall.com/lists/oss-security/2020/01/24/1
- https://plone.org/security/hotfix/20200121
- https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed
- https://www.openwall.com/lists/oss-security/2020/01/22/1
- http://www.openwall.com/lists/oss-security/2020/01/24/1