CVE-2012-5489
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
CVE-2012-5489 is a medium vulnerability (CVSS 6.5) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in zope2 2.12.21.
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
CVE-2012-5489- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
CVE-2012-5489- Updated
- 2026-11-02
EUVDEUVD-2014-0049 No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
EUVD-2014-0049- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-879r-7f3w-8jj3
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
GHSA-879r-7f3w-8jj3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-879r-7f3w-8jj3
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
GHSA-879r-7f3w-8jj3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVPYSEC-2014-31 No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
PYSEC-2014-31- Updated
- 2026-11-02
OSVPYSEC-2014-74 No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 2.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
PYSEC-2014-74- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2PyPI |
before 2.12.21 | 2.12.21 |
zope2PyPI |
2.13.0 up to 2.13.11 | 2.13.11 |
plonePyPI |
3.2.2 up to 4.2.3 | 4.2.3 |
plonePyPI |
4.3a1 to 4.3a2 | 4.3b1 |
zope2PyPI |
before 2.12.21, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 25 moreShow less2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.32.12.42.12.52.12.62.12.72.12.82.12.9 |
2.12.21 |
zope2PyPI |
2.13.0 up to 2.13.11, plus listed versions 2.13.12.13.102.13.22.13.32.13.4 Show 5 moreShow less2.13.52.13.62.13.72.13.82.13.9 |
2.13.11 |
plonePyPI |
3.2.2 up to 4.2.3, plus listed versions 3.2.33.33.3.13.3.23.3.3 Show 45 moreShow less3.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3 |
4.2.3 |
plonePyPI |
4.3a1 up to 4.3b1, plus listed versions 4.3a2 |
4.3b1 |
plonePyPI |
before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
4.2.34.3b1 |
zope2PyPI |
before 2.12.21, 2.13 up to 2.13.11, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 36 moreShow less2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.02.13.12.13.102.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.9 |
2.12.212.13.11 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
openwall.com/lists/oss-security/2012/11/10/1
plone.org/products/plone/security/advisories/20121106/05
bugs.launchpad.net/zope2/+bug/1079238
nvd.nist.gov/vuln/detail/CVE-2012-5489
Left out here: 25 versions. The JSON record has them.