Read the docs
TI-2012-04614 Aliases CVE-2012-5495GHSA-w6pw-5gh5-4952

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to…

Priority LOW 26CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."

Why it matters now

EPSS 0.01679 77th percentileScored 2026-11-07
Fix Fixed Plone (PyPI): 4.2.3, 4.3b1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Plone (PyPI)before 4.2.34.2.3Patch availableGHSA-w6pw-5gh5-4952
—Plone (PyPI)4.3a1 to before 4.3b14.3b1Patch availableGHSA-w6pw-5gh5-4952
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Plone (PyPI) Vendor— Affected before 4.2.3 Fixed in 4.2.3 Patch available GHSA-w6pw-5gh5-4952
  • Plone (PyPI) Vendor— Affected 4.3a1 to before 4.3b1 Fixed in 4.3b1 Patch available GHSA-w6pw-5gh5-4952

CPE configurations NVD · 72

CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*up to 4.2.2Vulnerableplone
cpe:2.3:a:plone:plone:1.0:*:*:*:*:*:*:*1.0Vulnerableplone
cpe:2.3:a:plone:plone:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerableplone
cpe:2.3:a:plone:plone:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerableplone
cpe:2.3:a:plone:plone:1.0.3:*:*:*:*:*:*:*1.0.3Vulnerableplone
cpe:2.3:a:plone:plone:1.0.4:*:*:*:*:*:*:*1.0.4Vulnerableplone
cpe:2.3:a:plone:plone:1.0.5:*:*:*:*:*:*:*1.0.5Vulnerableplone
cpe:2.3:a:plone:plone:1.0.6:*:*:*:*:*:*:*1.0.6Vulnerableplone
cpe:2.3:a:plone:plone:2.0:*:*:*:*:*:*:*2.0Vulnerableplone
cpe:2.3:a:plone:plone:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerableplone
  • cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:* Versions up to 4.2.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·plone
Show 62 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:2.0.2:*:*:*:*:*:*:*2.0.2Vulnerableplone
cpe:2.3:a:plone:plone:2.0.3:*:*:*:*:*:*:*2.0.3Vulnerableplone
cpe:2.3:a:plone:plone:2.0.4:*:*:*:*:*:*:*2.0.4Vulnerableplone
cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:*2.0.5Vulnerableplone
cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*2.1Vulnerableplone
cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerableplone
cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerableplone
cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerableplone
cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*2.1.4Vulnerableplone
cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*2.5Vulnerableplone
cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*2.5.1Vulnerableplone
cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*2.5.2Vulnerableplone
cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*2.5.3Vulnerableplone
cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*2.5.4Vulnerableplone
cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*2.5.5Vulnerableplone
cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*3.0Vulnerableplone
cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*3.0.1Vulnerableplone
cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*3.0.2Vulnerableplone
cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*3.0.3Vulnerableplone
cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*3.0.4Vulnerableplone
cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*3.0.5Vulnerableplone
cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*3.0.6Vulnerableplone
cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*3.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*3.1.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*3.1.2Vulnerableplone
cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*3.1.3Vulnerableplone
cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*3.1.4Vulnerableplone
cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*3.1.5.1Vulnerableplone
cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*3.1.6Vulnerableplone
cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*3.1.7Vulnerableplone
cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*3.2Vulnerableplone
cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*3.2.1Vulnerableplone
cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*3.2.2Vulnerableplone
cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*3.2.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*3.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*3.3.1Vulnerableplone
cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*3.3.2Vulnerableplone
cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*3.3.3Vulnerableplone
cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*3.3.4Vulnerableplone
cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*3.3.5Vulnerableplone
cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*4.0Vulnerableplone
cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerableplone
cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerableplone
cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerableplone
cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerableplone
cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerableplone
cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*4.0.6.1Vulnerableplone
cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*4.1Vulnerableplone
cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*4.1.4Vulnerableplone
cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*4.1.5Vulnerableplone
cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*4.1.6Vulnerableplone
cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*4.2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:a1:*:*:*:*:*:*4.2 a1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:a2:*:*:*:*:*:*4.2 a2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:b1:*:*:*:*:*:*4.2 b1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:b2:*:*:*:*:*:*4.2 b2Vulnerableplone
cpe:2.3:a:plone:plone:4.2:rc1:*:*:*:*:*:*4.2 rc1Vulnerableplone
cpe:2.3:a:plone:plone:4.2:rc2:*:*:*:*:*:*4.2 rc2Vulnerableplone
cpe:2.3:a:plone:plone:4.2.0.1:*:*:*:*:*:*:*4.2.0.1Vulnerableplone
cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*4.2.1Vulnerableplone
cpe:2.3:a:plone:plone:4.2.1.1:*:*:*:*:*:*:*4.2.1.1Vulnerableplone
cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*4.3Vulnerableplone
  • cpe:2.3:a:plone:plone:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:* Versions 3.1.5.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:* Versions 3.1.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:* Versions 3.3.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:* Versions 3.3.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:* Versions 4.0.6.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:a1:*:*:*:*:*:* Versions 4.2 a1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:a2:*:*:*:*:*:* Versions 4.2 a2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:b1:*:*:*:*:*:* Versions 4.2 b1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:b2:*:*:*:*:*:* Versions 4.2 b2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:rc1:*:*:*:*:*:* Versions 4.2 rc1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2:rc2:*:*:*:*:*:* Versions 4.2 rc2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.0.1:*:*:*:*:*:*:* Versions 4.2.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.2.1.1:*:*:*:*:*:*:* Versions 4.2.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·plone

Remediation

  • Fix · GHSA-w6pw-5gh5-4952 Plone (PyPI) Fixed in 4.2.3 Advisory →
  • Fix · GHSA-w6pw-5gh5-4952 Plone (PyPI) Fixed in 4.3b1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5495
  2. 2026-10-03 Alias added: GHSA-w6pw-5gh5-4952

References

Patch 1

Advisory 2

Other 4

  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
  • TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
  • TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
  • TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
  • TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences