Every CVESearch/Get API key

CVE-2011-3587

Zope Command Execution Vulnerability

9.3 HighPublic exploitFix available

CVE-2011-3587 is a high vulnerability (CVSS 9.3) in Plone, published October 10, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 78.1%, the 99th percentile. Fixed in zope2 2.12.20.

What does this mean?
Severity
9.3 HighCVSS 2.0, NVD
Exploit chance
78.1%EPSS, 99th percentile
Exploitation
None known2 public exploits
Fixed in
2.12.20zope2 +4 more

Description

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Exploit likelihood

78.1%Down 2.5 points since Feb 4, 2022
90%50%10%1%

Discussion

Quiet in the last day.
14 days ago: 0 people13 days ago: 0 people12 days ago: 0 people11 days ago: 0 people10 days ago: 0 people9 days ago: 0 people8 days ago: 0 people7 days ago: 0 people6 days ago: 0 people5 days ago: 1 person4 days ago: 0 people3 days ago: 0 people2 days ago: 0 people1 day ago: 0 peopleLast 24 hours: 0 people

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zope2
PyPI
2.12.0 up to 2.12.20
2.12.20
zope2
PyPI
2.13.0 up to 2.13.10
2.13.10
zope2
PyPI
2.12.0 up to 2.12.20, plus listed versions
2.12.12.12.102.12.112.12.122.12.13
Show 14 moreShow less
2.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.9
2.12.20
zope2
PyPI
2.13.0 up to 2.13.10, plus listed versions
2.13.12.13.22.13.32.13.42.13.5
Show 4 moreShow less
2.13.62.13.72.13.82.13.9
2.13.10
zope2
PyPI
2.12.0 up to 2.12.20, 2.13.0 up to 2.13.10, plus listed versions
2.12.12.12.102.12.112.12.122.12.13
Show 23 moreShow less
2.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.12.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.9
2.12.202.13.10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPlone and Zope XMLTools Remote Command Execution2011-10-04
Exploit-DBPlone and Zope - Remote Command Execution2011-12-21

What each source reports

NVD Score used9.3

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
CVE-2011-3587
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE ListNo score

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
CVE-2011-3587
Updated
2026-11-02
EUVDEUVD-2011-0026No score

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
EUVD-2011-0026
Updated
2026-11-03
GitHub AdvisoriesGHSA-8w48-m6hx-rjw2No score

Zope Command Execution Vulnerability

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
GHSA-8w48-m6hx-rjw2
Updated
2026-11-02
OSVGHSA-8w48-m6hx-rjw2No score

Zope Command Execution Vulnerability

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
GHSA-8w48-m6hx-rjw2
Updated
2026-11-02
OSVPYSEC-2011-26No score

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
PYSEC-2011-26
Updated
2026-11-02
OSVPYSEC-2026-1067No score

Zope Command Execution Vulnerability

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Record
PYSEC-2026-1067
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, facts
affected
affected, aliases, referencesEUVD
first indexedOSV
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 10 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open