Description

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.

Remediation

References

CVE-2024-23756

Related Vulnerabilities

WebLogic CVE-2016-3499 Vulnerability (CVE-2016-3499)

Moodle Other Vulnerability (CVE-2023-5550)

Oracle HTTP Server Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2022-0391)

WordPress Plugin blogVault Real-time Backup PHP Object Injection (1.44)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-1413)

Severity

High

Classification

CVE-2024-23756 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities