CVE-2024-22889: Plone Phone Information Disclosure Vulnerability
Summary
CVE-2024-22889: Phone information disclosure vulnerability. Affects plone versions < 6.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, security features, and user-friendly interface. However, like any software, it can be susceptible to vulnerabilities that may compromise its security. The vulnerability identified as CVE-2024-22889 affects Plone version 6.0.9, allowing unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from incorrect access control mechanisms in Plone version 6.0.9. This flaw allows remote attackers to send crafted requests that can reveal and list all files hosted on the website. The implications of this vulnerability are significant, as it can lead to unauthorized information disclosure, potentially exposing sensitive data to malicious actors. The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to sensitive files and directories through server configuration settings, ensuring that only authorized users can access them. This can be done by modifying the server's access control lists (ACLs) or using firewall rules to limit exposure.
Conclusion
The CVE-2024-22889 vulnerability in Plone poses a risk of unauthorized information disclosure due to incorrect access control. It is crucial for users to update to a patched version to mitigate this risk. Additionally, temporary workarounds can be employed to enhance security until an update can be performed.
See every vulnerability recorded for plone →
FAQ
CVE-2024-22889 is a vulnerability in Plone that allows unauthorized access to view and list all files hosted on the website due to incorrect access control.
Plone version 6.0.9 is affected by this vulnerability.
The risks include unauthorized information disclosure, which can lead to exposure of sensitive data to attackers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement access control measures and restrict access to sensitive files as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
