| Package | Affected versions | Patched versions |
|---|---|---|
| plone | ≥ 4.0, < 4.0.10≥ 4.1, < 4.1.1≥ 4.2a1, < 4.2a3 | 4.0.104.1.14.2a3 |
| cmfeditions | = 2.0a1= 2.0b1= 2.0b2= 2.0b3= 2.0b4= 2.0b5= 2.0b6= 2.0b7= 2.0b8= 2.0b9 | |
| plone | = 4.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6.1= 4.0.7= 4.0.8= 4.0.9= 4.1= 4.2= 4.2a1= 4.2a2 |
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free