CVE-2011-4030
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
CVE-2011-4030 is a high vulnerability (CVSS 9.3) in Plone Cmfeditions, published October 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in plone 4.0.10.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 1.99%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.10plone +5 more
Description
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI | 4.0 to 4.0.9 | 4.0.10 |
plonePyPI | 4.1 up to 4.1.1 | 4.1.1 |
plonePyPI | 4.2a1 to 4.2a2 | 4.2a3 |
plonePyPI | 4.0 up to 4.0.10, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 4 moreShow less4.0.64.0.74.0.84.0.9 | 4.0.10 |
plonePyPI | 4.2a1 up to 4.2a3, plus listed versions 4.2a2 | 4.2a3 |
plonePyPI | 4.0 up to 4.0.10, 4.1 up to 4.1.1, 4.2a1 up to 4.2a3, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 5 moreShow less4.0.64.0.74.0.84.0.94.2a2 | 4.0.104.1.14.2a3 |
What each source reports
NVD Score used
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
CVE-2011-4030- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
CVE-2011-4030- Updated
- 2026-11-02
EUVDEUVD-2011-0027No score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
EUVD-2011-0027- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwgm-jvqv-6v8pNo score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
GHSA-pwgm-jvqv-6v8p- Updated
- 2026-11-02
OSVGHSA-pwgm-jvqv-6v8pNo score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
GHSA-pwgm-jvqv-6v8p- Updated
- 2026-11-02
OSVPYSEC-2011-27No score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
PYSEC-2011-27- Updated
- 2026-11-02
OSVPYSEC-2026-897No score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
PYSEC-2026-897- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| affected, aliases, references | EUVD | |
| first indexed | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.