Vulnerability Description
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
CVSS Score
4.3
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Plone | Plone | <= 4.2.2 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2012/11/10/1
- https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
- https://plone.org/products/plone-hotfix/releases/20121106Patch
- https://plone.org/products/plone/security/advisories/20121106/07Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/10/1
- https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
- https://plone.org/products/plone-hotfix/releases/20121106Patch
- https://plone.org/products/plone/security/advisories/20121106/07Vendor Advisory
FAQ
What is CVE-2012-5491?
CVE-2012-5491 is a vulnerability with a CVSS score of 4.3 (MEDIUM). z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
How severe is CVE-2012-5491?
CVE-2012-5491 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5491?
Check the references section above for vendor advisories and patch information. Affected products include: Plone Plone.