Description

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

Remediation

References

CVE-2007-5741

Related Vulnerabilities

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0155)

MyBB Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-4629)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Multiple Vulnerabilities (1.12.25)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5340)

Oracle Application Server Other Vulnerability (CVE-2007-3861)

Severity

High

Classification

CVE-2007-5741 CWE-94

Tags

Missing Update Known Vulnerabilities