CVE-2012-5489: Plone - Unauthorized Access to Restricted Attributes
Summary
CVE-2012-5489: The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restric... Affects plone across 2 version ranges.
< 4.2.3
>= 4.3a0, < 4.3b1
Fixed in 4.2.3 or 4.3b1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2012-5489 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is a content management system (CMS) built on top of the Zope application server. It provides an easy-to-use interface for managing and publishing content on the web. Plone is widely used for creating websites, intranets, and collaborative workspaces. However, a vulnerability in the App.Undo.UndoSupport.get_request_var_or_attr function in Zope, which is used by Plone, allows remote authenticated users to gain access to restricted attributes.
Vulnerability Detail
The vulnerability (CVE-2012-5489) arises from a flaw in the App.Undo.UndoSupport.get_request_var_or_attr function in Zope. It affects Plone versions before 4.2.3 and 4.3 before beta 1. Remote authenticated users can exploit this vulnerability through unspecified vectors to gain access to restricted attributes. The exact vectors are not disclosed in the available information. This unauthorized access can lead to potential security breaches and unauthorized actions within the Plone CMS.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.34.2.3pip install --upgrade "plone==4.2.3" -
>= 4.3a0, < 4.3b14.3b1pip install --upgrade "plone==4.3b1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is mentioned in the available information. It is advised to follow the recommended fix and upgrade to the patched versions of Plone.
Conclusion
The vulnerability (CVE-2012-5489) in Plone allows remote authenticated users to gain unauthorized access to restricted attributes. To mitigate this vulnerability, it is crucial to upgrade to Plone version 4.2.3 or later, or version 4.3 beta 1 or later. These versions include the necessary fixes to prevent unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is a popular content management system (CMS) built on top of the Zope application server. It provides an easy-to-use interface for managing and publishing content on the web.
The vulnerability allows remote authenticated users to gain access to restricted attributes in Plone. This unauthorized access can potentially lead to security breaches and unauthorized actions within the CMS.
Plone versions before 4.2.3 and 4.3 before beta 1 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Plone version 4.2.3 or later, or version 4.3 beta 1 or later. These versions include the necessary fixes to prevent unauthorized access to restricted attributes.
No specific workaround is mentioned in the available information. It is advised to follow the recommended fix and upgrade to the patched versions of Plone.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
