CVE-2011-2528: Plone and Zope2 privilege escalation via incorrect security fix

CVE-2011-2528 · Severity: high · CVSS 7.5 · Published 2018-07-23

Plone and Zope are popular open-source content management systems and web application frameworks used to build and manage websites. A serious security flaw was discovered that could allow an unauthorized person to gain elevated administrative privileges on the site. This could lead to unauthorized access to sensitive data, modification of website content, or disruption of services. The issue was caused by an incomplete fix for a previous security problem, and administrators are advised to apply the latest security patches immediately.

Technologies: plone (PyPI), Zope2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2011-2528 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2011-2528 being exploited in the wild.
How severe is CVE-2011-2528?
High severity, with a CVSS score of 7.5, published 23 July 2018.
Which products and versions are affected?
plone (PyPI) ECOSYSTEM:introduced=0,last_affected=3.0,last_affected=3.0.1,last_affected=3.0.2,last_affected=3.0.3,last_affected=3.0.4,last_affected=3.0.5,last_affected=3.0.6,last_affected=3.1,last_affected=3.1.1,last_affected=3.1.2,last_affected=3.1.3,last_affected=3.1.4,last_affected=3.1.5.1,last_affected=3.1.6,last_affected=3.1.7,last_affected=3.2,last_affected=3.2.1,last_affected=3.2.2,last_affected=3.2.3,last_affected=3.3,last_affected=3.3.1,last_affected=3.3.2,last_affected=3.3.3,last_affected=3.3.4,last_affected=3.3.5,last_affected=3.3.6,last_affected=4.0,last_affected=4.0.1,last_affected=4.0.2,last_affected=4.0.3,last_affected=4.0.4,last_affected=4.0.5,last_affected=4.0.6.1,last_affected=4.0.7,last_affected=4.0.8,last_affected=4.1,last_affected=2.12.0,last_affected=2.12.0-a1,last_affected=2.12.0-a2,last_affected=2.12.0-a3,last_affected=2.12.0-a4,last_affected=2.12.0-b1,last_affected=2.12.0-b2,last_affected=2.12.0-b3,last_affected=2.12.0-b4,last_affected=2.12.1,last_affected=2.12.2,last_affected=2.12.3,last_affected=2.12.4,last_affected=2.12.5,last_affected=2.12.6,last_affected=2.12.7,last_affected=2.12.8,last_affected=2.12.9,last_affected=2.12.10,last_affected=2.12.11,last_affected=2.12.12,last_affected=2.12.13,last_affected=2.12.14,last_affected=2.12.15,last_affected=2.12.16,last_affected=2.12.17,last_affected=2.12.18,last_affected=2.13.0,last_affected=2.13.0-a1,last_affected=2.13.0-a2,last_affected=2.13.0-a3,last_affected=2.13.0-a4,last_affected=2.13.0-b1,last_affected=2.13.0-c1,last_affected=2.13.1,last_affected=2.13.2,last_affected=2.13.3,last_affected=2.13.4,last_affected=2.13.5,last_affected=2.13.6,last_affected=2.13.7, ECOSYSTEM:introduced=3.3.2,fixed=3.3.6; Zope2 (PyPI) ECOSYSTEM:introduced=2.12.0,fixed=2.12.19, ECOSYSTEM:introduced=2.12.0,fixed=2.12.19,introduced=2.13.0,fixed=2.13.8.
Is there a fix for CVE-2011-2528?
Yes. plone (PyPI): upgrade to 3.3.6 or later; Zope2 (PyPI): upgrade to 2.12.19, 2.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-2528 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2011-2528?
Check whether you run plone (PyPI) or Zope2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • plone (PyPI): upgrade to 3.3.6 or later
    pip install "plone>=3.3.6"
  • Zope2 (PyPI): upgrade to 2.12.19, 2.13.8 or later
    pip install "Zope2>=2.13.8"

Technical details

An unspecified privilege escalation vulnerability exists in Zope 2.12.x (before 2.12.19), Zope 2.13.x (before 2.13.8), and Plone 3.x (specifically when using PloneHotfix20110720). The root cause is an incorrect or incomplete fix for a previous vulnerability (CVE-2011-0720). While the exact technical vector is not detailed in the advisory, it is described as a 'highly serious' flaw that allows attackers to gain privileges via unspecified vectors. The vulnerability is reachable over the network without authentication. Fixes are available in Zope 2.12.19, Zope 2.13.8, and Plone 3.3.6 (or via PloneHotfix20110622).

Affected products

  • Plone Foundation Plone >= 3.3.2, < 3.3.6
  • Zope Foundation Zope2 >= 2.12.0, < 2.12.19; >= 2.13.0, < 2.13.8

Identifiers

  • CVE-2011-2528
  • GHSA-p6h9-hpcg-c6gm
  • PYSEC-2011-25
  • PYSEC-2011-32
  • PYSEC-2026-764

Timeline

  • 2011-06-22: patched: PloneHotfix20110622 released
  • 2011-06-28: advisory: Zope security hotfix announcement
  • 2011-07-19: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.