CVE-2012-6661: Zope PRNG Reseeding Vulnerability in Plone
Summary
CVE-2012-6661: Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. Affects plone across 2 version ranges.
< 4.2.3
>= 4.3a0, < 4.3b1
Fixed in 4.2.3 or 4.3b1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2012-6661 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and web applications. Plone is widely used for its robustness, security, and extensibility. However, a vulnerability has been discovered in Zope, the underlying framework used by Plone, which affects versions prior to 2.13.19. This vulnerability allows remote attackers to guess the value of the pseudo-random number generator (PRNG) due to a lack of reseeding. Plone versions before 4.2.3 and 4.3 before beta 1 are affected.
Vulnerability Detail
The vulnerability in Zope arises from its failure to reseed the PRNG. This oversight makes it easier for remote attackers to guess the value of the PRNG, potentially leading to the compromise of cryptographic keys, session tokens, or other sensitive information. The exact vectors through which the value can be guessed are unspecified. This vulnerability was split from CVE-2012-5508 due to being a different vulnerability type (ADT2).
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.34.2.3pip install --upgrade "plone==4.2.3" -
>= 4.3a0, < 4.3b14.3b1pip install --upgrade "plone==4.3b1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to the patched versions of Plone.
Conclusion
The Zope PRNG reseeding vulnerability in Plone versions prior to 4.2.3 and 4.3 beta 1 can allow remote attackers to guess the value of the PRNG, potentially leading to the compromise of sensitive information. To mitigate this vulnerability, it is essential to update to the recommended patched versions of Plone. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Zope is an open-source web application server written in Python. It provides a framework for building web applications and content management systems. Plone, a popular CMS, is built on top of Zope.
The vulnerability allows remote attackers to guess the value of the PRNG, which can lead to the compromise of sensitive information such as cryptographic keys or session tokens.
Plone versions before 4.2.3 and 4.3 before beta 1 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the recommended fix to mitigate the risk.
No, there is no known workaround for this vulnerability. Updating to the patched versions of Plone is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
