CVE-2007-5741: Plone Arbitrary Code Execution via Unsafe… – CVSS 7.5 · Watchpost

← All vulnerabilities

Plone Arbitrary Code Execution via Unsafe Handling of Pickles

HIGH 7.5CVE-2007-5741 · GHSA-hf26-vvmx-x8c8 · PYSEC-2007-4 · Published 07/11/2007 · updated 16/06/2026

In short

CVE-2007-5741 is a HIGH (CVSS 7.5) vulnerability affecting plone, plone (plone).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.6% of all vulnerabilities.
Fix: update to 2.5.5, 3.0.3 or later.

Package	Affected versions	Patched versions
plone PyPI	`≥ 2.5, < 2.5.5≥ 3.0, < 3.0.3`	`2.5.53.0.3`
plone plone	`= 2.5= 2.5.1= 2.5.1_rc= 2.5.4= 2.5_beta1= 3.0= 3.0.1= 3.0.2`	No fix yet

Description

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

NVD description

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

References

nvd.nist.gov/vuln/detail/CVE-2007-5741 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/38288 · WEB
plone/Plone · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741 · WEB
web.archive.org/web/20080517012557/http://www.securityfocus.com/bid/26354 · WEB
web.archive.org/web/20080906150436/http://www.securityfocus.com/archive/1/483343/100/0/threaded · WEB
plone.org/about/security/advisories/cve-2007-5741 · WEB
debian.org/security/2007/dsa-1405 · WEB
osvdb.org/42071
osvdb.org/42072
secunia.com/advisories/27530

More vulnerabilities in plone

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free