CVE-2024-23756

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-23756

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23756.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-23756

Published

2024-02-08T00:00:00Z

Modified

2026-07-08T07:57:18.165838368Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23756.json"
}

References

Affected packages

Git / github.com/plone/plone

Affected ranges

Type

GIT

Repo

https://github.com/plone/plone

Events

Introduced

7f990bb9821bedd2c18e3a7b70dc58e0c25c6a39

Last affected

7f990bb9821bedd2c18e3a7b70dc58e0c25c6a39

Database specific

{
    "extracted_events": [
        {
            "introduced": "5.2.13"
        },
        {
            "last_affected": "5.2.13"
        }
    ],
    "cpe": "cpe:2.3:a:plone:plone:5.2.13:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

5.*

5.2.13

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23756.json"