CVE-2011-2528
High severity vulnerability that affects Plone and Zope2
CVE-2011-2528 is a high vulnerability (CVSS 7.5) in Plone, published July 19, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in plone 3.3.6.
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
CVE-2011-2528- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
CVE-2011-2528- Updated
- 2026-11-02
EUVDEUVD-2011-0023 No score
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
EUVD-2011-0023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6h9-hpcg-c6gm No score
High severity vulnerability that affects Plone and Zope2
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
GHSA-p6h9-hpcg-c6gm- Updated
- 2026-11-02
OSVGHSA-p6h9-hpcg-c6gm No score
High severity vulnerability that affects Plone and Zope2
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
GHSA-p6h9-hpcg-c6gm- Updated
- 2026-11-02
OSVPYSEC-2011-25 No score
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
PYSEC-2011-25- Updated
- 2026-11-02
OSVPYSEC-2011-32 No score
Withdrawn as duplicate of PYSEC-2011-25. Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
PYSEC-2011-32- Updated
- 2026-11-02
OSVPYSEC-2026-764 No score
High severity vulnerability that affects Plone and Zope2
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
- Record
PYSEC-2026-764- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
3.3.2 up to 3.3.6 | 3.3.6 |
zope2PyPI |
2.12.0 up to 2.12.19 | 2.12.19 |
zope2PyPI |
2.13.0 up to 2.13.8 | 2.13.8 |
plonePyPI |
3.3.2 up to 3.3.6, plus listed versions 3.3.33.3.43.3.5 |
3.3.6 |
zope2PyPI |
2.12.0 up to 2.12.19, plus listed versions 2.12.12.12.102.12.112.12.122.12.13 Show 13 moreShow less2.12.142.12.152.12.162.12.172.12.182.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.9 |
2.12.19 |
zope2PyPI |
2.13.0 up to 2.13.8, plus listed versions 2.13.12.13.22.13.32.13.42.13.52.13.62.13.7 |
2.13.8 |
zope2PyPI |
2.12.0 up to 2.12.19, 2.13.0 up to 2.13.8, plus listed versions 2.12.12.12.102.12.112.12.122.12.13 Show 20 moreShow less2.12.142.12.152.12.162.12.172.12.182.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.12.13.22.13.32.13.42.13.52.13.62.13.7 |
2.12.192.13.8 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/45056
plone.org/products/plone/security/advisories/20110622
bugzilla.redhat.com/show_bug.cgi?id=718824
openwall.com/lists/oss-security/2011/07/12/9
mail.zope.org/pipermail/zope-announce/2011-June/002260.html
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2011-2528
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-25.yaml
pypi.org/project/zope2