Plone arbitrary code execution

Description
  • A vulnerability exists in Zope 2.12.x and Zope 2.13.x allows execution of arbitrary code by anonymous users. This is a severe vulnerability that allows an unauthenticated attacker to employ a carefully crafted web request to execute arbitrary commands with the privileges of the Zope/Plone service. <br/><br/> <strong>Versions Affected:</strong> Plone 4.0 (through 4.0.9); Plone 4.1; Plone 4.2 (a1 and a2); Zope 2.12.x and Zope 2.13.x.<br/> <strong>Versions Not Affected:</strong> Versions of Plone that use Zope other than Zope 2.12.x and Zope 2.13.x.<br/>
Remediation
  • Apply the Plone Hotfix 20110928 (Oct 04, 2011).
References