Advisory details:
pypa / zope2/PYSEC-2026-1067
| Advisory ID | pypa/zope2/PYSEC-2026-1067 |
| Aliases |
CVE-2011-3587
GHSA-8w48-m6hx-rjw2 PYSEC-2026-1067 |
| Summary | Zope Command Execution Vulnerability Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the `p_` class in `OFS/misc_.py` and the use of Python modules. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| There are no known severity scores. | ||
| Data source | Metasploit |
|---|---|
| Description | Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 4, 2011 |
| Platform | Linux,Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/plone_popen2.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 21, 2011 |
| Description | Plone and Zope - Remote Command Execution |
| Ransomware campaign use | Known |
| Source publication date | Dec. 21, 2011 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | Dec. 22, 2011 |
| Source URL | http://plone.org/products/plone/security/advisories/20110928 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.