Description

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

Remediation

References

CVE-2007-5741

Related Vulnerabilities

Perl Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-4330)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-1636)

MediaWiki Improper Access Control Vulnerability (CVE-2016-6331)

Chamilo Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32925)

WordPress Plugin WP Upload Restriction Multiple Vulnerabilities (2.2.3)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-94 CVE-2007-5741