CVE-2020-7941: Plone Unauthenticated Write Vulnerability in plone-app-contenttypes
Summary
CVE-2020-7941: Plone Unauthenticated Write Vulnerability. Affects plone-app-contenttypes versions 1.0 – 5.0.1. No fix is published. How to fix ↓
Also tracked for
The same CVE-2020-7941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
plone.app.contenttypes is a package within the Plone ecosystem, which is a robust content management system (CMS) built on Python. It allows users to create, manage, and publish web content efficiently. The package provides various content types and functionalities that enhance the Plone experience. However, it has been identified that versions 4.3 through 5.2.1 are susceptible to a privilege escalation vulnerability that can be exploited by unauthorized users.
Vulnerability Detail
The vulnerability arises from a flaw in the permission checks within plone.app.contenttypes, allowing users to perform PUT requests to overwrite existing content without possessing the necessary write permissions. This can lead to unauthorized modifications of content, potentially compromising the integrity of the application and exposing sensitive information. The vulnerability has a CVSS score of 9.8, indicating a critical severity level that necessitates immediate attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected content types by modifying the permissions in your Plone instance. This can be done through the Plone control panel by adjusting the roles and permissions associated with content types to prevent unauthorized users from making changes.
Conclusion
The CVE-2020-7941 vulnerability in the plone.app.contenttypes package poses a significant risk by allowing unauthorized content modifications. It is crucial for users to update to the patched version to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for plone-app-contenttypes →
FAQ
CVE-2020-7941 is a vulnerability in the plone.app.contenttypes package that allows unauthorized users to overwrite content without proper permissions.
The vulnerability affects plone.app.contenttypes versions from 4.3 to 5.2.1.
Exploitation of this vulnerability can lead to unauthorized content modifications, compromising the integrity of the application and potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is recommended to update the plone-app-contenttypes package to version 2.1.6 or later to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for plone-app-contenttypes.
