GHSA-pwgm-jvqv-6v8p CVE-2011-4030 PYSEC-2026-897

Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable

High PyPI

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 1.99%; Chance of exploitation in the next 30 days. Higher than 80.67% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 4.0.10; Upgrade plone to this version or later

Description

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Affected versions

PyPI

Package	Vulnerable	Fixed in
plone	`>= 4.0, < 4.0.10`	`4.0.10`
plone	`>= 4.1, < 4.1.1`	`4.1.1`
plone	`>= 4.2a1, < 4.2a3`	`4.2a3`
plone	`>= 4.0, < 4.0.10` `>= 4.1, < 4.1.1` `>= 4.2a1, < 4.2a3`	`4.0.10` `4.1.1` `4.2a3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

plone PyPI → `4.0.10`

pip

pip install --upgrade "plone>=4.0.10"

poetry

poetry add "plone>=4.0.10"

uv

uv add "plone>=4.0.10"

References

Advisories

Packages

Timeline

May 17, 2022 Published
Jul 7, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-xg5p-8wg5-rhxm Phone information disclosure vulnerability	High	Also affects plone
GHSA-5xfx-55x4-j223 Cross-Frame Scripting vulnerability has been found on Plone CMS	High	Also affects plone
GHSA-47p5-p3jw-w78w Server-Side Request Forgery in Plone CMS	High	Also affects plone
GHSA-cvwc-g7fw-7xrj Plone XSS Vulnerability	Medium	Also affects plone
GHSA-46f9-f8jm-mw2x Plone Cross-site Scripting vulnerability in the LiveSearch module	Medium	Also affects plone
GHSA-hjp5-hv33-q58g Plone credentials stored in session cookie	Medium	Also affects plone
GHSA-593c-j348-f3gv Plone Improper Session Management	High	Also affects plone
GHSA-mq3q-jjph-rp5p Plone CMS Improper Session Management	High	Also affects plone

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor