CVE-2012-5507
Plone and Zope2 affected by Race Condition
CVE-2012-5507 is a medium vulnerability (CVSS 4.3) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in zope2 2.13.19.
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
Exploit likelihood
What each source reports
NVD Score used
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
CVE-2012-5507- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
CVE-2012-5507- Updated
- 2026-11-02
EUVDEUVD-2014-0067 No score
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
EUVD-2014-0067- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qpr-7rmg-73v8
Plone and Zope2 affected by Race Condition
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
GHSA-3qpr-7rmg-73v8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-3qpr-7rmg-73v8
Plone and Zope2 affected by Race Condition
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
GHSA-3qpr-7rmg-73v8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVPYSEC-2014-49 No score
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
PYSEC-2014-49- Updated
- 2026-11-02
OSVPYSEC-2014-75 No score
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
- Record
PYSEC-2014-75- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2PyPI |
before 2.13.19 | 2.13.19 |
plonePyPI |
3.2.2 up to 4.2.3 | 4.2.3 |
plonePyPI |
4.3a1 to 4.3a2 | 4.3b1 |
zope2PyPI |
before 2.13.19, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 45 moreShow less2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.212.12.222.12.232.12.242.12.252.12.262.12.272.12.282.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.02.13.0a12.13.0a22.13.0a32.13.0a42.13.0b12.13.0c12.13.12.13.102.13.112.13.122.13.13 |
2.13.19 |
plonePyPI |
3.2.2 up to 4.2.3, plus listed versions 3.2.33.33.3.13.3.23.3.3 Show 45 moreShow less3.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3 |
4.2.3 |
plonePyPI |
4.3a1 up to 4.3b1, plus listed versions 4.3a2 |
4.3b1 |
plonePyPI |
before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
4.2.34.3b1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
bugs.launchpad.net/zope2/+bug/1071067
openwall.com/lists/oss-security/2012/11/10/1
plone.org/products/plone-hotfix/releases/20121106
nvd.nist.gov/vuln/detail/CVE-2012-5507
Left out here: 38 versions. The JSON record has them.