Every CVESearch/Get API key

CVE-2012-5500

Plone contains Cross-site Request Forgery

4.3 MediumFix available

CVE-2012-5500 is a medium vulnerability (CVSS 4.3) in Plone, published November 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 66th percentile. Fixed in plone 4.2.3.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
1.10%EPSS, 66th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.2.3plone +8 more

Description

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Exploit likelihood

1.10%Down 0.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
plone
PyPI
before 4.2.3
4.2.3
plone
PyPI
4.3a1 up to 4.3b1
4.3b1
plone
PyPI
before 4.2.3, plus listed versions
3.23.2.13.2.23.2.33.2a1
Show 45 moreShow less
3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2
4.2.3
plone
PyPI
4.3a1 up to 4.3b1, plus listed versions
4.3a2
4.3b1
plone
PyPI
before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions
3.23.2.13.2.23.2.33.2a1
Show 45 moreShow less
3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2
4.2.34.3b1
conga
Red Hat:rhel_cluster:5
From an advisory covering 9 CVEs
before 0:0.12.2-81.el5
0:0.12.2-81.el5
conga-debuginfo
Red Hat:rhel_cluster:5
From an advisory covering 9 CVEs
before 0:0.12.2-81.el5
0:0.12.2-81.el5
luci
Red Hat:rhel_cluster:5
From an advisory covering 9 CVEs
before 0:0.12.2-81.el5
0:0.12.2-81.el5
ricci
Red Hat:rhel_cluster:5
From an advisory covering 9 CVEs
before 0:0.12.2-81.el5
0:0.12.2-81.el5

What each source reports

NVD Score used4.3

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
CVE-2012-5500
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-352
Updated
2026-11-02
CVE ListNo score

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
CVE-2012-5500
Updated
2026-11-02
EUVDEUVD-2014-0060No score

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
EUVD-2014-0060
Updated
2026-11-03
GitHub AdvisoriesGHSA-2q75-f7cp-w86q6.9

Plone contains Cross-site Request Forgery

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
GHSA-2q75-f7cp-w86q
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-2q75-f7cp-w86q6.9

Plone contains Cross-site Request Forgery

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
GHSA-2q75-f7cp-w86q
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-352
Updated
2026-11-02
OSVPYSEC-2014-42No score

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

Record
PYSEC-2014-42
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 46 moreShow less
This page doesn't list everything

Left out here: 30 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open