Every CVESearch/Get API key

CVE-2012-5492

Plone Metadata Disclosure

5.0 MediumFix available

CVE-2012-5492 is a medium vulnerability (CVSS 5.0) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 73rd percentile. Fixed in plone 4.2.3.

Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
1.41%EPSS, 73rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.2.3plone +4 more

Description

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Exploit likelihood

1.41%Up 0.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
plone
PyPI
before 4.2.3
4.2.3
plone
PyPI
4.3a0 up to 4.3b1
4.3b1
plone
PyPI
before 4.2.3, plus listed versions
3.23.2.13.2.23.2.33.2a1
Show 45 moreShow less
3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2
4.2.3
plone
PyPI
4.3a0 up to 4.3b1, plus listed versions
4.3a14.3a2
4.3b1
plone
PyPI
before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions
3.23.2.13.2.23.2.33.2a1
Show 45 moreShow less
3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2
4.2.34.3b1

What each source reports

NVD Score used5.0

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
CVE-2012-5492
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE ListNo score

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
CVE-2012-5492
Updated
2026-11-02
EUVDEUVD-2014-0052No score

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
EUVD-2014-0052
Updated
2026-11-03
GitHub AdvisoriesGHSA-6w93-4c4p-xv2x6.9

Plone Metadata Disclosure

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
GHSA-6w93-4c4p-xv2x
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-6w93-4c4p-xv2x6.9

Plone Metadata Disclosure

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
GHSA-6w93-4c4p-xv2x
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVPYSEC-2014-34No score

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

Record
PYSEC-2014-34
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

Left out here: 30 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open