Description
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
Remediation
References
Related Vulnerabilities
MySQL CVE-2024-21157 Vulnerability (CVE-2024-21157)
Apache Tomcat CVE-2018-1305 Vulnerability (CVE-2018-1305)
WordPress Plugin FireCask Like & Share Button Cross-Site Scripting (1.1.5)
WordPress Plugin Portfolio Gallery-Photo Gallery Cross-Site Scripting (1.5.7)
Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2009-1280)