Description

at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

Remediation

References

CVE-2012-5501

Related Vulnerabilities

WordPress Plugin WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection-StopBadBots Cross-Site Scripting (6.61)

Lodash Other Vulnerability (CVE-2019-10744)

Oracle Database Server CVE-2005-4884 Vulnerability (CVE-2005-4884)

Plone CMS Resource Management Errors Vulnerability (CVE-2012-5506)

WordPress Plugin Google Forms PHP Object Injection (0.87)

Severity

Medium

Classification

CVE-2012-5501 CWE-264

Tags

Missing Update Known Vulnerabilities