CVE-2020-7939
Plone SQL Injection Vulnerability
CVE-2020-7939 is a high vulnerability (CVSS 8.8) in Plone, published January 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 68th percentile. Fixed in plone 5.2.2.
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
CVE-2020-7939- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
CVE-2020-7939- Updated
- 2026-11-02
EUVDEUVD-2020-0146 No score
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
EUVD-2020-0146- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhmf-7rgg-gcw5
Plone SQL Injection Vulnerability
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
GHSA-hhmf-7rgg-gcw5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
CVE-2020-7939- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hhmf-7rgg-gcw5
Plone SQL Injection Vulnerability
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
GHSA-hhmf-7rgg-gcw5- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVPYSEC-2020-88 No score
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
- Record
PYSEC-2020-88- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
4.0 to 5.2.1 | None known |
plonePyPI |
4.0 to 5.2.1, plus listed versions 4.0.14.0.104.0.24.0.34.0.4 Show 45 moreShow less4.0.54.0.64.0.74.0.84.0.94.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.24.2.14.2.24.2.34.2.44.2.54.2.64.2.74.2a14.2a24.2b14.2b24.2rc14.2rc24.34.3.14.3.104.3.114.3.124.3.134.3.144.3.154.3.164.3.174.3.184.3.19 |
None known |
plonePyPI |
4.0 up to 5.2.2, plus listed versions 4.0.14.0.104.0.24.0.34.0.4 Show 45 moreShow less4.0.54.0.64.0.74.0.84.0.94.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.24.2.14.2.24.2.34.2.44.2.54.2.64.2.74.2a14.2a24.2b14.2b24.2rc14.2rc24.34.3.14.3.104.3.114.3.124.3.134.3.144.3.154.3.164.3.174.3.184.3.19 |
5.2.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
plone.org/security/hotfix/20200121
openwall.com/lists/oss-security/2020/01/22/1
nvd.nist.gov/vuln/detail/CVE-2020-7939
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-88.yaml
Left out here: 121 versions. The JSON record has them.