CVE-2020-7941 Plone Unauthenticated Write Vulnerability
Users can overwrite content without write permission in Plone, leading to unauthorized data modification and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7941?
CVE-2020-7941 is a critical missing authorization vulnerability in Plone Plone, published on 23 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Which versions are affected by CVE-2020-7941?
6 open source packages ship an affected version, including plone, Plone and plone-app-contenttypes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | From 4.3 to 5.2.1 | None |
plone PyPI | From 4.3 | 5.2.2 |
Plone PyPI | From 4.3 to 5.2.1 | None |
plone-app-contenttypes PyPI | All versions | None |
plone-app-contenttypes PyPI | All versions | 2.1.6 |
plone.app.contenttypes PyPI | All versions | None |
Products include Plone Plone.
How do I fix CVE-2020-7941?
Upgrade plone to 5.2.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-7941 being exploited?
There is no known exploitation of CVE-2020-7941 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
- CVE-2021-33509 Incorrect Permission Assignment for Critical Resource in Plone
- CVE-2020-35190 Hardcoded credentials in n/a
- CVE-2011-3587 Zope Command Execution Vulnerability
- CVE-2021-33926 Server-Side Request Forgery in Plone CMS
- CVE-2020-28734 Improper Restriction of XML External Entity Reference in Plone
Sources
Also known as GHSA-w6g9-xccc-347h, PYSEC-2020-90, PYSEC-2026-459.