Read the docs
TI-2012-04612 Aliases CVE-2012-5493GHSA-25jh-5h5r-h33m

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users…

Priority MEDIUM 40CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94 and CWE-693.

Summary

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

Why it matters now

EPSS 0.01711 77th percentileScored 2026-11-07
Fix Fixed Plone (PyPI): 4.2.3, 4.3b1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Plone (PyPI)before 4.2.34.2.3Patch availableGHSA-25jh-5h5r-h33m
—Plone (PyPI)4.3a0 to before 4.3b14.3b1Patch availableGHSA-25jh-5h5r-h33m
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Plone (PyPI) Vendor— Affected before 4.2.3 Fixed in 4.2.3 Patch available GHSA-25jh-5h5r-h33m
  • Plone (PyPI) Vendor— Affected 4.3a0 to before 4.3b1 Fixed in 4.3b1 Patch available GHSA-25jh-5h5r-h33m

CPE configurations NVD · 72

CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*up to 4.2.2Vulnerableplone
cpe:2.3:a:plone:plone:1.0:*:*:*:*:*:*:*1.0Vulnerableplone
cpe:2.3:a:plone:plone:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerableplone
cpe:2.3:a:plone:plone:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerableplone
cpe:2.3:a:plone:plone:1.0.3:*:*:*:*:*:*:*1.0.3Vulnerableplone
cpe:2.3:a:plone:plone:1.0.4:*:*:*:*:*:*:*1.0.4Vulnerableplone
cpe:2.3:a:plone:plone:1.0.5:*:*:*:*:*:*:*1.0.5Vulnerableplone
cpe:2.3:a:plone:plone:1.0.6:*:*:*:*:*:*:*1.0.6Vulnerableplone
cpe:2.3:a:plone:plone:2.0:*:*:*:*:*:*:*2.0Vulnerableplone
cpe:2.3:a:plone:plone:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerableplone
  • cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:* Versions up to 4.2.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·plone
Show 62 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:2.0.2:*:*:*:*:*:*:*2.0.2Vulnerableplone
cpe:2.3:a:plone:plone:2.0.3:*:*:*:*:*:*:*2.0.3Vulnerableplone
cpe:2.3:a:plone:plone:2.0.4:*:*:*:*:*:*:*2.0.4Vulnerableplone
cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:*2.0.5Vulnerableplone
cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*2.1Vulnerableplone
cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerableplone
cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerableplone
cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerableplone
cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*2.1.4Vulnerableplone
cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*2.5Vulnerableplone
cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*2.5.1Vulnerableplone
cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*2.5.2Vulnerableplone
cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*2.5.3Vulnerableplone
cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*2.5.4Vulnerableplone
cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*2.5.5Vulnerableplone
cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*3.0Vulnerableplone
cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*3.0.1Vulnerableplone
cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*3.0.2Vulnerableplone
cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*3.0.3Vulnerableplone
cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*3.0.4Vulnerableplone
cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*3.0.5Vulnerableplone
cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*3.0.6Vulnerableplone
cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*3.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*3.1.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*3.1.2Vulnerableplone
cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*3.1.3Vulnerableplone
cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*3.1.4Vulnerableplone
cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*3.1.5.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*3.1.6Vulnerableplone
cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*3.1.7Vulnerableplone
cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*3.2Vulnerableplone
cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*3.2.1Vulnerableplone
cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*3.2.2Vulnerableplone
cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*3.2.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*3.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*3.3.1Vulnerableplone
cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*3.3.2Vulnerableplone
cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*3.3.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*3.3.4Vulnerableplone
cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*3.3.5Vulnerableplone
cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*4.0Vulnerableplone
cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerableplone
cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerableplone
cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerableplone
cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerableplone
cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerableplone
cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*4.0.6.1Vulnerableplone
cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*4.1Vulnerableplone
cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*4.1.4Vulnerableplone
cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*4.1.5Vulnerableplone
cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*4.1.6Vulnerableplone
cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*4.2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:a1:*:*:*:*:*:*4.2 a1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:a2:*:*:*:*:*:*4.2 a2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:b1:*:*:*:*:*:*4.2 b1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:b2:*:*:*:*:*:*4.2 b2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:rc1:*:*:*:*:*:*4.2 rc1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:rc2:*:*:*:*:*:*4.2 rc2Vulnerableplone
cpe:2.3:a:plone:plone:4.2.0.1:*:*:*:*:*:*:*4.2.0.1Vulnerableplone
cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*4.2.1Vulnerableplone
cpe:2.3:a:plone:plone:4.2.1.1:*:*:*:*:*:*:*4.2.1.1Vulnerableplone
cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*4.3Vulnerableplone
  • cpe:2.3:a:plone:plone:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:* Versions 3.1.5.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:* Versions 3.1.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:* Versions 3.3.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:* Versions 3.3.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:* Versions 4.0.6.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:a1:*:*:*:*:*:* Versions 4.2 a1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:a2:*:*:*:*:*:* Versions 4.2 a2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:b1:*:*:*:*:*:* Versions 4.2 b1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:b2:*:*:*:*:*:* Versions 4.2 b2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:rc1:*:*:*:*:*:* Versions 4.2 rc1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:rc2:*:*:*:*:*:* Versions 4.2 rc2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.0.1:*:*:*:*:*:*:* Versions 4.2.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.1.1:*:*:*:*:*:*:* Versions 4.2.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·plone

Remediation

  • Fix · GHSA-25jh-5h5r-h33m Plone (PyPI) Fixed in 4.2.3 Advisory →
  • Fix · GHSA-25jh-5h5r-h33m Plone (PyPI) Fixed in 4.3b1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5493
  2. 2026-10-03 Alias added: GHSA-25jh-5h5r-h33m

References

Patch 1

Advisory 2

Other 4

  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
  • TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
  • TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
  • TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
  • TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences