CVE-2011-4030
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Exploit likelihood
What each source reports
NVD Score used
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
CVE-2011-4030- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
CVE-2011-4030- Updated
- 2026-11-02
EUVDEUVD-2011-0027 No score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
EUVD-2011-0027- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwgm-jvqv-6v8p No score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
GHSA-pwgm-jvqv-6v8p- Updated
- 2026-11-02
OSVGHSA-pwgm-jvqv-6v8p No score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
GHSA-pwgm-jvqv-6v8p- Updated
- 2026-11-02
OSVPYSEC-2011-27 No score
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
PYSEC-2011-27- Updated
- 2026-11-02
OSVPYSEC-2026-897 No score
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- Record
PYSEC-2026-897- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
4.0 to 4.0.9 | 4.0.10 |
plonePyPI |
4.1 up to 4.1.1 | 4.1.1 |
plonePyPI |
4.2a1 to 4.2a2 | 4.2a3 |
plonePyPI |
4.0 up to 4.0.10, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 4 moreShow less4.0.64.0.74.0.84.0.9 |
4.0.10 |
plonePyPI |
4.2a1 up to 4.2a3, plus listed versions 4.2a2 |
4.2a3 |
plonePyPI |
4.0 up to 4.0.10, 4.1 up to 4.1.1, 4.2a1 up to 4.2a3, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 Show 5 moreShow less4.0.64.0.74.0.84.0.94.2a2 |
4.0.104.1.14.2a3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, references | EUVD | |
| first indexed | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4030 is a high vulnerability (CVSS 9.3) in Plone Cmfeditions, published October 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in plone 4.0.10.