Read the docs
TI-2011-03558 Aliases CVE-2011-4030GHSA-pwgm-jvqv-6v8p

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2…

Priority MEDIUM 44CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.

Summary

The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

Why it matters now

EPSS 0.01991 80th percentileScored 2026-11-07
Fix Fixed Plone (PyPI): 4.0.10, 4.1.1, 4.2a3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Plone (PyPI)4.0 to before 4.0.104.0.10Patch availableGHSA-pwgm-jvqv-6v8p
—Plone (PyPI)4.1 to before 4.1.14.1.1Patch availableGHSA-pwgm-jvqv-6v8p
—Plone (PyPI)4.2a1 to before 4.2a34.2a3Patch availableGHSA-pwgm-jvqv-6v8p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Plone (PyPI) Vendor— Affected 4.0 to before 4.0.10 Fixed in 4.0.10 Patch available GHSA-pwgm-jvqv-6v8p
  • Plone (PyPI) Vendor— Affected 4.1 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-pwgm-jvqv-6v8p
  • Plone (PyPI) Vendor— Affected 4.2a1 to before 4.2a3 Fixed in 4.2a3 Patch available GHSA-pwgm-jvqv-6v8p

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:plone:cmfeditions:2.0a1:*:*:*:*:*:*:*2.0a1Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b1:*:*:*:*:*:*:*2.0b1Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b2:*:*:*:*:*:*:*2.0b2Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b3:*:*:*:*:*:*:*2.0b3Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b4:*:*:*:*:*:*:*2.0b4Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b5:*:*:*:*:*:*:*2.0b5Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b6:*:*:*:*:*:*:*2.0b6Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b7:*:*:*:*:*:*:*2.0b7Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b8:*:*:*:*:*:*:*2.0b8Vulnerableplone
cpe:2.3:a:plone:cmfeditions:2.0b9:*:*:*:*:*:*:*2.0b9Vulnerableplone
  • cpe:2.3:a:plone:cmfeditions:2.0a1:*:*:*:*:*:*:* Versions 2.0a1 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b1:*:*:*:*:*:*:* Versions 2.0b1 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b2:*:*:*:*:*:*:* Versions 2.0b2 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b3:*:*:*:*:*:*:* Versions 2.0b3 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b4:*:*:*:*:*:*:* Versions 2.0b4 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b5:*:*:*:*:*:*:* Versions 2.0b5 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b6:*:*:*:*:*:*:* Versions 2.0b6 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b7:*:*:*:*:*:*:* Versions 2.0b7 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b8:*:*:*:*:*:*:* Versions 2.0b8 Vulnerable ·plone
  • cpe:2.3:a:plone:cmfeditions:2.0b9:*:*:*:*:*:*:* Versions 2.0b9 Vulnerable ·plone
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*4.0Vulnerableplone
cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerableplone
cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerableplone
cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerableplone
cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerableplone
cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerableplone
cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*4.0.6.1Vulnerableplone
cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*4.0.7Vulnerableplone
cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*4.0.8Vulnerableplone
cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*4.0.9Vulnerableplone
cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*4.1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*4.2Vulnerableplone
cpe:2.3:a:plone:plone:4.2a1:*:*:*:*:*:*:*4.2a1Vulnerableplone
cpe:2.3:a:plone:plone:4.2a2:*:*:*:*:*:*:*4.2a2Vulnerableplone
  • cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:* Versions 4.0.6.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:* Versions 4.0.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:* Versions 4.0.8 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:* Versions 4.0.9 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2a1:*:*:*:*:*:*:* Versions 4.2a1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2a2:*:*:*:*:*:*:* Versions 4.2a2 Vulnerable ·plone

Remediation

  • Fix · GHSA-pwgm-jvqv-6v8p Plone (PyPI) Fixed in 4.0.10 Advisory →
  • Fix · GHSA-pwgm-jvqv-6v8p Plone (PyPI) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-pwgm-jvqv-6v8p Plone (PyPI) Fixed in 4.2a3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4030
  2. 2026-10-03 Alias added: GHSA-pwgm-jvqv-6v8p

References

Patch 3

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences