Description
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
Remediation
References
Related Vulnerabilities
MySQL CVE-2024-21247 Vulnerability (CVE-2024-21247)
Apache Tomcat Improper Authentication Vulnerability (CVE-2012-5886)
WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.22)
Oracle Application Server Other Vulnerability (CVE-2004-2134)
Oracle Database Server CVE-2014-4298 Vulnerability (CVE-2014-4298)