Unrestricted Access to Sub-Objects in CMFEditions Component

CVE-2011-4030 · HIGH Severity

AV:N/AC:M/AU:N/C:C/I:C/A:C

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Learn more about our Web Application Penetration Testing UK.