CVE-2012-5492: Plone - Metadata Disclosure Vulnerability
Summary
CVE-2012-5492: uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL. Affects plone across 2 version ranges.
< 4.2.3
>= 4.3a0, < 4.3b1
Fixed in 4.2.3 or 4.3b1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites, intranets, and collaborative workspaces. Plone allows users to create and organize content, customize the appearance, and extend functionality through add-ons and integrations. However, versions before 4.2.3 and 4.3 before beta 1 are vulnerable to a metadata disclosure issue.
Vulnerability Detail
The vulnerability (CVE-2012-5492) exists in the 'uid_catalog.py' module of Plone. It allows remote attackers to obtain metadata about hidden objects by exploiting a crafted URL. This disclosure of metadata can potentially reveal sensitive information or aid in further attacks. The issue was identified and reported in September 2014.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.34.2.3pip install --upgrade "plone==4.2.3" -
>= 4.3a0, < 4.3b14.3b1pip install --upgrade "plone==4.3b1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading to the patched versions is the best course of action.
Conclusion
The vulnerability in Plone (CVE-2012-5492) allows remote attackers to obtain metadata about hidden objects. It is crucial to upgrade to the patched versions (4.2.3 or later for versions prior to 4.2.3, and 4.3b1 or later for versions 4.3a0 and earlier) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites, intranets, and collaborative workspaces.
The vulnerability allows remote attackers to obtain metadata about hidden objects, potentially revealing sensitive information or aiding in further attacks.
To fix this vulnerability, upgrade to Plone version 4.2.3 or later if using a version prior to 4.2.3. For versions 4.3a0 and earlier, upgrade to version 4.3b1 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the patched versions is the recommended solution.
For more information about this vulnerability, you can refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-34.yaml
Related vulnerabilities
Recent vulnerabilities recorded for plone.
