CVE-2011-3587
Zope Command Execution Vulnerability
CVE-2011-3587 is a high vulnerability (CVSS 9.3) in Plone, published October 10, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 78.1%, the 99th percentile. Fixed in zope2 2.12.20.
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
CVE-2011-3587- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
CVE-2011-3587- Updated
- 2026-11-02
EUVDEUVD-2011-0026 No score
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
EUVD-2011-0026- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8w48-m6hx-rjw2 No score
Zope Command Execution Vulnerability
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
GHSA-8w48-m6hx-rjw2- Updated
- 2026-11-02
OSVGHSA-8w48-m6hx-rjw2 No score
Zope Command Execution Vulnerability
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
GHSA-8w48-m6hx-rjw2- Updated
- 2026-11-02
OSVPYSEC-2011-26 No score
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
PYSEC-2011-26- Updated
- 2026-11-02
OSVPYSEC-2026-1067 No score
Zope Command Execution Vulnerability
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
- Record
PYSEC-2026-1067- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2PyPI |
2.12.0 up to 2.12.20 | 2.12.20 |
zope2PyPI |
2.13.0 up to 2.13.10 | 2.13.10 |
zope2PyPI |
2.12.0 up to 2.12.20, plus listed versions 2.12.12.12.102.12.112.12.122.12.13 Show 14 moreShow less2.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.9 |
2.12.20 |
zope2PyPI |
2.13.0 up to 2.13.10, plus listed versions 2.13.12.13.22.13.32.13.42.13.5 Show 4 moreShow less2.13.62.13.72.13.82.13.9 |
2.13.10 |
zope2PyPI |
2.12.0 up to 2.12.20, 2.13.0 up to 2.13.10, plus listed versions 2.12.12.12.102.12.112.12.122.12.13 Show 23 moreShow less2.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.12.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.9 |
2.12.202.13.10 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Plone and Zope - Remote Command Execution | 2011-12-21 |
| Metasploit | Plone and Zope XMLTools Remote Command Execution | 2011-10-04 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | affected, aliases, references | EUVD |
| 2026-11-02 | created | OSV |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=742297
secunia.com/advisories/46221
pypi.python.org/pypi/Products.PloneHotfix20110928/1.0
plone.org/products/plone/security/advisories/20110928
zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2011-3587
github.com/zopefoundation/Zope/commit/491a583d8c6622b80c75917e5017c4bb4b15e477
web.archive.org/web/20111013043934/http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587
pypi.org/project/zope2