Description

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

Remediation

References

CVE-2007-5741

Related Vulnerabilities

Apache Traffic Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9515)

Magento CVE-2019-7896 Vulnerability (CVE-2019-7896)

Atlassian Jira Improper Privilege Management Vulnerability (CVE-2018-13400)

MySQL Other Vulnerability (CVE-2006-4226)

MySQL CVE-2020-14785 Vulnerability (CVE-2020-14785)

Severity

High

Classification

CVE-2007-5741 CWE-94

Tags

Missing Update Known Vulnerabilities