Description

The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

Remediation

References

CVE-2012-5487

Related Vulnerabilities

osTicket Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-14396)

WordPress Plugin Toggle The Title Cross-Site Scripting (1.4)

Moodle Other Vulnerability (CVE-2004-2233)

WordPress Plugin Shoppable Images Multiple Vulnerabilities (1.0.0)

WordPress Plugin Mass Pages/Posts Creator Cross-Site Scripting (1.2.2)

Severity

High

Classification

CVE-2012-5487 CWE-264

Tags

Missing Update Known Vulnerabilities