CVE-2024-22889 Phone information disclosure vulnerability

What is CVE-2024-22889?

CVE-2024-22889 is a medium-severity missing authorization vulnerability in Plone Plone, published on 5 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

Weakness: CWE-276

Which versions are affected by CVE-2024-22889?

3 open source packages ship an affected version, including plone and Plone. It affects 1 product.

Products include Plone Plone.

How do I fix CVE-2024-22889?

No fix has been published for CVE-2024-22889 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-22889 being exploited?

There is no known exploitation of CVE-2024-22889 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Plone Plone

• CVE-2021-33509 Incorrect Permission Assignment for Critical Resource in Plone Critical 9.9
• CVE-2020-35190 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-7941 Plone Unauthenticated Write Vulnerability Critical 9.8
• CVE-2011-3587 Zope Command Execution Vulnerability Critical 9.3
• CVE-2021-33926 Server-Side Request Forgery in Plone CMS High 8.8

All Plone Plone vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xg5p-8wg5-rhxm, PYSEC-2026-1798.