Description

The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

Remediation

References

CVE-2012-5487

Related Vulnerabilities

WordPress Plugin Art-Picture-Gallery Arbitrary File Upload (1.2.9)

TYPO3 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Vulnerability (CVE-2022-23504)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-1158)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-43400)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-1832)

Severity

High

Classification

CVE-2012-5487 CWE-264

Tags

Missing Update Known Vulnerabilities