Skip to content
Log inStart free trial

GHSA-p6h9-hpcg-c6gm CVE-2011-2528 PYSEC-2011-25 PYSEC-2011-32 PYSEC-2026-764

High severity vulnerability that affects Plone and Zope2

High PyPI
Severity
High
The publisher's own rating, not a CVSS score
Exploit chance (EPSS)
2.03%
Chance of exploitation in the next 30 days. Higher than 81.05% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
Available
2 packages have a fixed version

Description

Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.

Affected versions

PyPI

PackageVulnerableFixed in
plone
>= 3.3.2, < 3.3.6
3.3.6
plone
<= 3.0
<= 3.0.1
<= 3.0.2
<= 3.0.3
<= 3.0.4
<= 3.0.5
<= 3.0.6
<= 3.1
<= 3.1.1
<= 3.1.2
<= 3.1.3
<= 3.1.4
<= 3.1.5.1
<= 3.1.6
<= 3.1.7
<= 3.2
<= 3.2.1
<= 3.2.2
<= 3.2.3
<= 3.3
<= 3.3.1
<= 3.3.2
<= 3.3.3
<= 3.3.4
<= 3.3.5
<= 3.3.6
<= 4.0
<= 4.0.1
<= 4.0.2
<= 4.0.3
<= 4.0.4
<= 4.0.5
<= 4.0.6.1
<= 4.0.7
<= 4.0.8
<= 4.1
<= 2.12.0
<= 2.12.0-a1
<= 2.12.0-a2
<= 2.12.0-a3
<= 2.12.0-a4
<= 2.12.0-b1
<= 2.12.0-b2
<= 2.12.0-b3
<= 2.12.0-b4
<= 2.12.1
<= 2.12.2
<= 2.12.3
<= 2.12.4
<= 2.12.5
<= 2.12.6
<= 2.12.7
<= 2.12.8
<= 2.12.9
<= 2.12.10
<= 2.12.11
<= 2.12.12
<= 2.12.13
<= 2.12.14
<= 2.12.15
<= 2.12.16
<= 2.12.17
<= 2.12.18
<= 2.13.0
<= 2.13.0-a1
<= 2.13.0-a2
<= 2.13.0-a3
<= 2.13.0-a4
<= 2.13.0-b1
<= 2.13.0-c1
<= 2.13.1
<= 2.13.2
<= 2.13.3
<= 2.13.4
<= 2.13.5
<= 2.13.6
<= 2.13.7
 No fix yet
zope2
>= 2.12.0, < 2.12.19
2.12.19
zope2
>= 2.13.0, < 2.13.8
2.13.8
zope2
>= 2.12.0, < 2.12.19
>= 2.13.0, < 2.13.8
2.12.19
2.13.8

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

plone PyPI → 3.3.6

pip
pip install --upgrade "plone>=3.3.6"
poetry
poetry add "plone>=3.3.6"
uv
uv add "plone>=3.3.6"

zope2 PyPI → 2.12.19

pip
pip install --upgrade "zope2>=2.12.19"
poetry
poetry add "zope2>=2.12.19"
uv
uv add "zope2>=2.12.19"

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-xg5p-8wg5-rhxm
Phone information disclosure vulnerability
High Also affects plone
GHSA-5xfx-55x4-j223
Cross-Frame Scripting vulnerability has been found on Plone CMS
High Also affects plone
GHSA-47p5-p3jw-w78w
Server-Side Request Forgery in Plone CMS
High Also affects plone
GHSA-cvwc-g7fw-7xrj
Plone XSS Vulnerability
Medium Also affects plone
GHSA-pwgm-jvqv-6v8p
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
High Also affects plone
GHSA-46f9-f8jm-mw2x
Plone Cross-site Scripting vulnerability in the LiveSearch module
Medium Also affects plone
GHSA-hjp5-hv33-q58g
Plone credentials stored in session cookie
Medium Also affects plone
GHSA-593c-j348-f3gv
Plone Improper Session Management
High Also affects plone
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor