CVE-2012-5486: ZPublisher.HTTPRequest._scrubHeader Arbitrary Header Injection in Plone
Summary
CVE-2012-5486: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affects plone versions < 4.2.3. Fixed in 4.2.3. How to fix ↓
Also tracked for
The same CVE-2012-5486 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. The ZPublisher module in Plone is responsible for handling HTTP requests and responses. However, a vulnerability in the ZPublisher.HTTPRequest._scrubHeader function allows remote attackers to inject arbitrary HTTP headers by exploiting a linefeed (LF) character. This vulnerability affects Plone versions prior to 4.3 beta 1.
Vulnerability Detail
The ZPublisher.HTTPRequest._scrubHeader function in Plone fails to properly sanitize user-supplied input, specifically linefeed characters. This allows an attacker to inject arbitrary HTTP headers into the request, potentially leading to various security issues. By injecting malicious headers, an attacker could manipulate the behavior of the application, perform cross-site scripting (XSS) attacks, or bypass security controls. This vulnerability poses a significant risk to the integrity and security of Plone-based websites and applications.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.3
This is the first release that contains the fix.
pip install --upgrade "plone==4.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Plone is not immediately feasible, a temporary workaround can be implemented by manually patching the affected code. The following code snippet demonstrates the necessary changes:
# Patch for ZPublisher.HTTPRequest._scrubHeader vulnerability
from ZPublisher.HTTPRequest import HTTPRequest
def patched_scrubHeader(self, name, value):
if value.find('\n') >= 0:
value = value.replace('\n', '')
return self.orig_scrubHeader(name, value)
# Apply the patch
HTTPRequest.orig_scrubHeader = HTTPRequest._scrubHeader
HTTPRequest._scrubHeader = patched_scrubHeader
By applying this patch, the vulnerable function is modified to remove any linefeed characters from the input value, effectively preventing header injection.
Conclusion
The vulnerability in Plone's ZPublisher.HTTPRequest._scrubHeader function allows remote attackers to inject arbitrary HTTP headers, posing a significant risk to the security and integrity of Plone-based applications. It is crucial to upgrade to Plone version 4.3 beta 1 or later to mitigate this vulnerability. Alternatively, a temporary workaround can be applied by manually patching the affected code. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
This vulnerability allows remote attackers to inject arbitrary HTTP headers into Plone-based applications. Depending on the specific scenario, this can lead to various security issues such as manipulation of application behavior, cross-site scripting (XSS) attacks, or bypassing security controls.
Plone versions prior to 4.3 beta 1 are affected by this vulnerability.
Yes, upgrading to Plone version 4.3 beta 1 or later includes the necessary fix for this vulnerability.
Yes, a temporary workaround can be implemented by manually patching the affected code. Details of the patch can be found in the 'workaround' section of this report.
For more information about this vulnerability, you can refer to the official advisory provided by the Plone project. The advisory can be found at the following URL: https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-28.yaml
Related vulnerabilities
Recent vulnerabilities recorded for plone.
