Skip to content

CVE-2012-5503

Plone allows remote attackers to read hidden folder contents

5.0 MediumFix available

CVE-2012-5503 is a medium vulnerability (CVSS 5.0) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in plone 4.2.3.

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Exploit likelihood

2.14%Up 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: CVE-2012-5503
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: CVE-2012-5503
Updated: 2026-11-02

EUVDEUVD-2014-0063 No score

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: EUVD-2014-0063
Updated: 2026-11-03

GitHub AdvisoriesGHSA-prr5-pfr8-q9f3 8.7

Plone allows remote attackers to read hidden folder contents

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: GHSA-prr5-pfr8-q9f3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-prr5-pfr8-q9f3 8.7

Plone allows remote attackers to read hidden folder contents

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: GHSA-prr5-pfr8-q9f3
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVPYSEC-2014-45 No score

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Record: PYSEC-2014-45
Updated: 2026-11-02

Affected products

plone

Affected packages

Affected packages
Package	Affected	Fixed
`plone` PyPI	before 4.2.3	4.2.3
`plone` PyPI	4.3a1 to 4.3a2	4.3b1
`plone` PyPI	before 4.2.3, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2	4.2.3
`plone` PyPI	4.3a1 up to 4.3b1, plus listed versions 4.3a2	4.3b1
`plone` PyPI	before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2	4.2.34.3b1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 30 versions. The JSON record has them.