CVE-2012-5489
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
CVE-2012-5489 is a medium vulnerability (CVSS 6.5) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in zope2 2.12.21.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 1.94%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.12.21zope2 +9 more
Description
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2PyPI | before 2.12.21 | 2.12.21 |
zope2PyPI | 2.13.0 up to 2.13.11 | 2.13.11 |
plonePyPI | 3.2.2 up to 4.2.3 | 4.2.3 |
plonePyPI | 4.3a1 to 4.3a2 | 4.3b1 |
zope2PyPI | before 2.12.21, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 25 moreShow less2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.32.12.42.12.52.12.62.12.72.12.82.12.9 | 2.12.21 |
zope2PyPI | 2.13.0 up to 2.13.11, plus listed versions 2.13.12.13.102.13.22.13.32.13.4 Show 5 moreShow less2.13.52.13.62.13.72.13.82.13.9 | 2.13.11 |
plonePyPI | 3.2.2 up to 4.2.3, plus listed versions 3.2.33.33.3.13.3.23.3.3 Show 45 moreShow less3.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3 | 4.2.3 |
plonePyPI | 4.3a1 up to 4.3b1, plus listed versions 4.3a2 | 4.3b1 |
plonePyPI | before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 | 4.2.34.3b1 |
zope2PyPI | before 2.12.21, 2.13 up to 2.13.11, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 36 moreShow less2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.02.13.12.13.102.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.9 | 2.12.212.13.11 |
What each source reports
NVD Score used
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
CVE-2012-5489- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
CVE-2012-5489- Updated
- 2026-11-02
EUVDEUVD-2014-0049No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
EUVD-2014-0049- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-879r-7f3w-8jj3
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
GHSA-879r-7f3w-8jj3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-879r-7f3w-8jj3
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
GHSA-879r-7f3w-8jj3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVPYSEC-2014-31No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
PYSEC-2014-31- Updated
- 2026-11-02
OSVPYSEC-2014-74No score
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 2.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
- Record
PYSEC-2014-74- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
openwall.com/lists/oss-security/2012/11/10/1
plone.org/products/plone/security/advisories/20121106/05
bugs.launchpad.net/zope2/+bug/1079238
nvd.nist.gov/vuln/detail/CVE-2012-5489
Left out here: 25 versions. The JSON record has them.