CVE-2011-4030 Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
Remote attackers can access restricted sub-objects in Plone's CMFEditions component due to missing authorization checks on publishable classes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-4030?
CVE-2011-4030 is a critical missing authorization vulnerability in Plone Plone, published on 10 Oct 2011. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Weakness: CWE-264
Which versions are affected by CVE-2011-4030?
7 open source packages ship an affected version, including plone and Plone. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | From 4.0 | 4.0.10, 4.1.1, 4.2a3 |
plone PyPI | From 4.0 | 4.0.10 |
plone PyPI | From 4.1 | 4.1.1 |
plone PyPI | From 4.2a1 | 4.2a3 |
Plone PyPI | From 4.0 | 4.0.10 |
Plone PyPI | From 4.1 | 4.1.1 |
1 more packages
Plone PyPI | From 4.2a1 | 4.2a3 |
Products include Plone Cmfeditions, Plone Plone.
How do I fix CVE-2011-4030?
Upgrade plone to a fixed version for your release line: 4.0.10, 4.1.1 or 4.2a3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2011-4030 being exploited?
There is no known exploitation of CVE-2011-4030 in the wild and no public exploit code.
Sources
Also known as GHSA-pwgm-jvqv-6v8p, PYSEC-2026-897.