CVE-2024-22889: Phone information disclosure vulnerability in Plone
Summary
CVE-2024-22889: Phone information disclosure vulnerability. Affects plone versions < 6.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system built on top of the Zope application server. It provides an intuitive interface for managing websites and supports various features such as content creation, collaboration, and version control. Plone is widely used for building secure and scalable web applications.
Vulnerability Detail
The vulnerability identified as CVE-2024-22889 affects Plone version 6.0.9. It arises from incorrect access control, allowing remote attackers to view and list all files hosted on the website by sending a crafted request. This can lead to the disclosure of sensitive information, including phone numbers, stored within the files. The vulnerability poses a moderate risk and can potentially compromise user privacy and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Plone.
Conclusion
The phone information disclosure vulnerability in Plone version 6.0.9 can potentially expose sensitive information to remote attackers. It is crucial to upgrade to a patched version of Plone to mitigate this risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system that provides an intuitive interface for managing websites and supports various features such as content creation, collaboration, and version control.
The vulnerability allows remote attackers to view and list all files hosted on the website, potentially leading to the disclosure of sensitive information, including phone numbers.
Plone version 6.0.9 is affected by this vulnerability.
No, there is no specific workaround available. It is recommended to upgrade to a patched version of Plone.
To fix this vulnerability, it is recommended to upgrade your Plone installation to a version beyond 6.0.9, which includes the necessary security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
