Skip to main content

Zope CVE-2012-5507

MEDIUM
Race Condition (CWE-362)
2014-09-30 secalert@redhat.com
Information Disclosure Race Condition Zope Plone
4.3
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
M
Confidentiality
P
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 30, 2014 - 14:55 cve.org
MEDIUM 4.3

DescriptionCVE.org

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

AnalysisAI

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-362. AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation. Affected products include: Zope, Plone. Version information: before 2.13.19.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Zope

View all
CVE-2015-7293 HIGH POC
8.8 Sep 25

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone bef
CVE-2021-32633 HIGH POC
8.8 May 21

Zope is an open-source web application server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitabl
CVE-2024-47532 HIGH POC
8.7 Sep 30

RestrictedPython is a restricted execution environment for Python to run untrusted code. Rated high severity (CVSS 8.7),
CVE-2021-36089 HIGH POC
7.8 Jul 01

Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from g
CVE-2021-21337 MEDIUM POC
6.1 Mar 08

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. Rated medium severity (CVS
CVE-2023-37271 CRITICAL
9.9 Jul 11

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program

CVE-2024-24811 CRITICAL
9.8 Feb 07

SQLAlchemyDA is a generic database adapter for ZSQL methods. Rated critical severity (CVSS 9.8), this vulnerability is r
CVE-2023-42458 MEDIUM POC
5.4 Sep 21

Zope is an open-source web application server. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploita
CVE-2012-6661 MEDIUM POC
5.0 Nov 03

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number gener
CVE-2021-32674 HIGH
8.8 Jun 08

Zope is an open-source web application server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitabl
CVE-2023-41050 HIGH
7.7 Sep 06

AccessControl provides a general security framework for use in Zope. Rated high severity (CVSS 7.7), this vulnerability

CVE-2023-41039 HIGH
7.7 Aug 30

RestrictedPython is a restricted execution environment for Python to run untrusted code. Rated high severity (CVSS 7.7),

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2012-5507 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy