Description

at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

Remediation

References

CVE-2012-5501

Related Vulnerabilities

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14330)

WordPress Plugin MailPoet Newsletters (Previous) SQL Injection (2.2)

OpenSSL Resource Management Errors Vulnerability (CVE-2011-3210)

Caddy Web Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-29718)

WordPress Plugin GorillaForms-Custom Contact Forms Unspecified Vulnerability (2.0.3)

Severity

Medium

Classification

CVE-2012-5501 CWE-264

Tags

Missing Update Known Vulnerabilities