GHSA-m7f9-65wr-pwch

Suggest an improvement
Source
https://github.com/advisories/GHSA-m7f9-65wr-pwch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m7f9-65wr-pwch/GHSA-m7f9-65wr-pwch.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-m7f9-65wr-pwch
Aliases
Published
2022-05-14T02:46:12Z
Modified
2024-10-18T15:49:01.120756Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Plone vulnerable to filesystem information leak
Details

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

Database specific
{
    "nvd_published_at": "2017-03-07T16:59:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-29T11:17:59Z"
}
References

Affected packages

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0
Fixed
5.0.7

Affected versions

5.*

5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2
Fixed
4.3.12

Affected versions

4.*

4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3a1
4.3a2
4.3b1
4.3b2
4.3rc1
4.3
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11