Is CVE-2012-5493 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2012-5493 being exploited in the wild.

How severe is CVE-2012-5493?

Low severity, with a CVSS score of 3.1, published 30 September 2014.

Which products and versions are affected?

Plone 3.0 through 4.2.2, and 4.3a1 through 4.3a2; plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.2.3,introduced=4.3a0,fixed=4.3b1.

Is there a fix for CVE-2012-5493?

Yes. plone (PyPI): upgrade to 4.3b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2012-5493 attacked?

It is attacked over the network.

Am I affected by CVE-2012-5493?

Check whether you run Plone or plone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2012-5493: Plone sandbox bypass via gtbn.py

CVE-2012-5493 · Severity: low · CVSS 3.1 · Published 2014-09-30

Plone is a widely-used open-source content management system that runs websites and intranets for many organizations. This vulnerability allows authenticated users with certain administrative permissions to execute arbitrary Python code on the server by bypassing Plone's security sandbox. An attacker with such permissions could gain complete control over the application, access sensitive data, or disrupt service.

Technologies: Plone, plone (PyPI). Vendors: Plone, PyPI.

Quick answers

Is CVE-2012-5493 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2012-5493 being exploited in the wild.
How severe is CVE-2012-5493?: Low severity, with a CVSS score of 3.1, published 30 September 2014.
Which products and versions are affected?: Plone 3.0 through 4.2.2, and 4.3a1 through 4.3a2; plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.2.3,introduced=4.3a0,fixed=4.3b1.
Is there a fix for CVE-2012-5493?: Yes. plone (PyPI): upgrade to 4.3b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2012-5493 attacked?: It is attacked over the network.
Am I affected by CVE-2012-5493?: Check whether you run Plone or plone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

plone (PyPI): upgrade to 4.3b1 or later
```
pip install "plone>=4.3b1"
```

Technical details

The vulnerability exists in gtbn.py in Plone before version 4.2.3 and 4.3 beta 1, and is classified as a sandbox bypass (CWE-693, CWE-94). Remote authenticated users who possess certain permissions can bypass Plone's Python sandbox protection through unspecified vectors, allowing execution of arbitrary Python code on the server. The attack requires valid authentication credentials and specific administrative or developer-level permissions within Plone, but no user interaction beyond issuing the exploit. Patches are available in Plone 4.2.3 and later, as well as in 4.3 beta 1 and beyond.

Affected products

Plone Plone 3.0 through 4.2.2, and 4.3a1 through 4.3a2

Identifiers

CVE-2012-5493
GHSA-25jh-5h5r-h33m
PYSEC-2014-35

Timeline

2012-11-06: disclosed
2012-11-06: patched
2022-05-17: advisory

References

https://github.com/plone/Plone

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.