Description
at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
Remediation
References
Related Vulnerabilities
WordPress Plugin Visitors Online by BestWebSoft Cross-Site Scripting (0.9)
WebLogic Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-10152)
TYPO3 Deserialization of Untrusted Data Vulnerability (CVE-2019-19849)
Drupal CVE-2017-6919 Vulnerability (CVE-2017-6919)
WordPress Plugin GEO my WordPress Unspecified Vulnerability (2.6.1.1)