Description

at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

Remediation

References

CVE-2012-5501

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9507)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-6514)

WordPress Plugin Display Posts Shortcode Unspecified Vulnerability (1.9)

Ruby Resource Management Errors Vulnerability (CVE-2008-3443)

WordPress Plugin WooCommerce Upload Files Arbitrary File Upload (59.3)

Severity

Medium

Classification

CVE-2012-5501 CWE-264

Tags

Missing Update Known Vulnerabilities