CVE-2012-5485

Plone Code Injection vulnerability

6.8 MediumFix available

CVE-2012-5485 is a medium vulnerability (CVSS 6.8) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in plone 4.2.3.

What does this mean?

Severity: 6.8 MediumCVSS 2.0, NVD
Exploit chance: 2.10%EPSS, 81st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.2.3plone +8 more

Description

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Exploit likelihood

2.10%Up 0.9 points since Feb 4, 2022

Affected products

plone

Affected packages

Affected packages
Package	Affected	Fixed
`plone` PyPI	before 4.2.3	4.2.3
`plone` PyPI	4.3a1 up to 4.3b1	4.3b1
`plone` PyPI	before 4.2.3, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2	4.2.3
`plone` PyPI	4.3a1 up to 4.3b1, plus listed versions 4.3a2	4.3b1
`plone` PyPI	before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2	4.2.34.3b1
`conga` Red Hat:rhel_cluster:5 From an advisory covering 9 CVEs	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`conga-debuginfo` Red Hat:rhel_cluster:5 From an advisory covering 9 CVEs	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`luci` Red Hat:rhel_cluster:5 From an advisory covering 9 CVEs	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`ricci` Red Hat:rhel_cluster:5 From an advisory covering 9 CVEs	before 0:0.12.2-81.el5	0:0.12.2-81.el5

What each source reports

NVD Score used6.8

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: CVE-2012-5485
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE ListNo score

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: CVE-2012-5485
Updated: 2026-11-02

EUVDEUVD-2014-0045No score

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: EUVD-2014-0045
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7hxc-mwx7-5hmc8.6

Plone Code Injection vulnerability

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: GHSA-7hxc-mwx7-5hmc
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-7hxc-mwx7-5hmc8.6

Plone Code Injection vulnerability

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: GHSA-7hxc-mwx7-5hmc
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVPYSEC-2014-27No score

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

Record: PYSEC-2014-27
Updated: 2026-11-02