CVE-2012-5488: Plone Remote Code Execution
Summary
CVE-2012-5488: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject. Affects plone across 2 version ranges.
< 4.2.3
>= 4.3a0, < 4.3b1
Fixed in 4.2.3 or 4.3b1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone offers features such as content versioning, workflow management, and a powerful search engine. However, versions before 4.2.3 and 4.3 beta 1 are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability (CVE-2012-5488) in Plone allows remote attackers to execute Python code by exploiting a flaw in the 'python_scripts.py' script. This can be achieved by sending a specially crafted URL to the affected Plone instance. The vulnerability is related to the 'createObject' function. Successful exploitation of this vulnerability can lead to arbitrary code execution, potentially compromising the entire Plone installation and the underlying server.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.34.2.3pip install --upgrade "plone==4.2.3" -
>= 4.3a0, < 4.3b14.3b1pip install --upgrade "plone==4.3b1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a newer version of Plone is not immediately feasible, a temporary workaround is to disable the 'python_scripts' feature in the Plone configuration. This can be achieved by modifying the Plone configuration files and commenting out or removing the 'python_scripts' entry. However, this workaround may impact the functionality of certain Plone features that rely on 'python_scripts'. It is strongly recommended to upgrade to a patched version as soon as possible.
Conclusion
The vulnerability in Plone (CVE-2012-5488) allows remote code execution, posing a significant security risk to affected installations. To mitigate this risk, it is crucial to upgrade to Plone version 4.2.3 or later. Alternatively, disabling the 'python_scripts' feature can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
The vulnerability allows remote attackers to execute arbitrary Python code on the affected Plone instance. This can lead to complete compromise of the Plone installation and the underlying server.
To fix this vulnerability, it is recommended to upgrade to Plone version 4.2.3 or later. This will ensure that the necessary security patches are applied.
If upgrading to a newer version is not immediately feasible, a temporary workaround is to disable the 'python_scripts' feature in the Plone configuration. However, this may impact certain Plone features that rely on 'python_scripts'. It is strongly recommended to upgrade to a patched version as soon as possible.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is important to address this vulnerability promptly to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
