PYSEC-2026-897
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2026-897.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-897
- Aliases
-
- CVE-2011-4030
- GHSA-pwgm-jvqv-6v8p
- Published
- 2026-07-06T08:03:27.332968Z
- Modified
- 2026-07-07T11:45:17.337877161Z
- Summary
- Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
- Details
-
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2011-4030
- https://github.com/plone/Plone
- https://github.com/pypa/advisory-database/tree/main/vulns/products-plonehotfix20110928/PYSEC-2011-27.yaml
- http://plone.org/products/plone-hotfix/releases/20110928
- http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip
- http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0
- https://pypi.org/project/plone
- https://github.com/advisories/GHSA-pwgm-jvqv-6v8p
Affected packages
PyPI / plone
Package
- Name
- plone
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone