Date: Thu, 29 Sep 2011 17:59:38 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com, Plone Security Team <security@...ne.org> Subject: CVE Request -- Zope/Plone -- Unspecified vulnerability in Zope v2.12.x and Zope v2.13.x allowing arbitrary code execution Hello Josh, Steve, vendors, Plone upstream has published a pre-announcement about a security flaw, present in Zope v2.12.x and Zope v2.13.x, which could allow execution of arbitrary code by anonymous users. An authenticated attacker could provide a specially-crafted web page, which once visited by an unsuspecting Zope user would lead to arbitrary commands execution with the privileges of the Zope/Plone service. References:  http://plone.org/products/plone/security/advisories/20110928  http://secunia.com/advisories/46221/  https://bugzilla.redhat.com/show_bug.cgi?id=742297 Note: The vendor announced the final version of the advisory and the patch to be available at 2011-10-04 15:00 UTC at the following location:  http://plone.org/products/plone/security/advisories/20110928 Could you allocate a CVE id for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.