CVE-2012-5501
N/A
Published: September 30, 2014 at 02:00 PM UTC
Updated: June 16, 2026 at 11:46 PM UTC
1 product affected across 1 vendorPlone
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 1%
Description
at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≤ 4.2.21.01.0.11.0.21.0.31.0.41.0.51.0.62.02.0.12.0.22.0.32.0.42.0.52.12.1.12.1.22.1.32.1.42.52.5.12.5.22.5.32.5.42.5.53.03.0.13.0.23.0.33.0.43.0.53.0.63.13.1.13.1.23.1.33.1.43.1.5.13.1.63.1.73.23.2.13.2.23.2.33.33.3.13.3.23.3.33.3.43.3.54.04.0.14.0.24.0.34.0.44.0.54.0.6.14.14.1.44.1.54.1.64.24.2 a14.2 a24.2 b14.2 b24.2 rc14.2 rc24.2.0.14.2.14.2.1.14.3
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (4)
Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2012/11/10/1x_refsource_CONFIRM
Source: [email protected]
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txtx_refsource_CONFIRMPatch
Source: [email protected]
https://plone.org/products/plone-hotfix/releases/20121106x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://plone.org/products/plone/security/advisories/20121106/17Quick Info
StatusMODIFIED
CWE
CWE-264
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card