{"id":"CVE-2012-5491","aliases":["EUVD-2014-0051","GHSA-f8pg-wp5j-rjxx","PYSEC-2014-33"],"status":"published","title":"Plone Information Disclosure","description":"z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01243,"percentile":0.69385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-09-30T14:00:00Z","modified":"2026-06-16T23:46:52Z","fixes":[{"ecosystem":"PyPI","package":"plone","fixed_in":["4.2.3","4.3b1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3a0"},{"fixed":"4.3b1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3"}]}],"versions":["3.2","3.2.1","3.2.2","3.2.3","3.2a1","3.2rc1","3.3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3b1","3.3rc1","3.3rc2","3.3rc3","3.3rc4","3.3rc5","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0rc1","4.1","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1a1","4.1a2","4.1a3","4.1b1","4.1b2","4.1rc2","4.1rc3","4.2","4.2.1","4.2.2","4.2a1","4.2a2","4.2b1","4.2b2","4.2rc1","4.2rc2"]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3a0"},{"fixed":"4.3b1"}]}],"versions":["4.3a1","4.3a2"]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3"},{"introduced":"4.3a0"},{"fixed":"4.3b1"}]}],"versions":["3.2","3.2.1","3.2.2","3.2.3","3.2a1","3.2rc1","3.3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3b1","3.3rc1","3.3rc2","3.3rc3","3.3rc4","3.3rc5","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0rc1","4.1","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1a1","4.1a2","4.1a3","4.1b1","4.1b2","4.1rc2","4.1rc3","4.2","4.2.1","4.2.2","4.2a1","4.2a2","4.2b1","4.2b2","4.2rc1","4.2rc2","4.3a1","4.3a2"]}],"products":[{"vendor":"plone","product":"plone"}],"references":[{"url":"https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/11/10/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://plone.org/products/plone/security/advisories/20121106/07","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://plone.org/products/plone-hotfix/releases/20121106","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5491","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-33.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f8pg-wp5j-rjxx","tags":["advisory"]},{"url":"https://github.com/plone/Plone","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-5491","description":"z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2014-09-30T14:00:00Z","modified":"2024-08-06T21:05:47.305Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2014-0051","description":"z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2014-09-30T14:00:00Z","modified":"2024-08-06T21:05:47Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-f8pg-wp5j-rjxx","title":"Plone Information Disclosure","description":"`z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2022-05-17T04:32:26Z","modified":"2024-10-11T20:45:58Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2012-5491","description":"z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2014-09-30T14:55:06.11Z","modified":"2026-06-16T23:46:52.66Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:17.748457Z"}],"osv":[{"id":"GHSA-f8pg-wp5j-rjxx","title":"Plone Information Disclosure","description":"`z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2022-05-17T04:32:26Z","modified":"2024-10-14T18:57:53.963245Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"PYSEC-2014-33","description":"z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.","status":"published","published":"2014-09-30T14:55:00Z","modified":"2026-06-10T17:02:30.438133337Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}