CVE-2012-5486: HTTP header injection in Plone and Zope2
Summary
CVE-2012-5486: HTTP header injection in Plone and Zope2. Affects zope2 versions < 2.13.19. Fixed in 2.13.19. How to fix ↓
Also tracked for
- plone · PyPI
The same CVE-2012-5486 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system built on top of the Zope application server. It provides an intuitive interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Zope2 is the underlying framework on which Plone is built. It provides a robust and flexible platform for developing web applications.
However, both Plone and Zope2 are susceptible to an HTTP header injection vulnerability. This vulnerability exists in the ZPublisher.HTTPRequest._scrubHeader function in Zope 2 before version 2.13.19. It allows remote attackers to inject arbitrary HTTP headers by exploiting a linefeed (LF) character.
This vulnerability can have serious consequences as it enables attackers to manipulate HTTP headers, potentially leading to various attacks such as cross-site scripting (XSS), session hijacking, and cache poisoning.
Vulnerability Detail
The HTTP header injection vulnerability in Plone and Zope2 arises from inadequate sanitization of user-supplied input. The ZPublisher.HTTPRequest._scrubHeader function, which is responsible for cleaning up HTTP headers, fails to properly handle linefeed characters. An attacker can exploit this by injecting a linefeed character into a header value, thereby introducing additional headers or modifying existing ones.
The consequences of this vulnerability can be severe. Attackers can manipulate headers to inject malicious content, bypass security controls, or impersonate legitimate users. For example, they can inject arbitrary headers to perform cross-site scripting attacks, modify cookies to hijack sessions, or tamper with caching mechanisms to poison cache data.
It is important to note that this vulnerability affects Plone versions prior to 4.3 beta 1 and Zope2 versions prior to 2.13.19.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
pip install --upgrade "zope2==4.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.13.19
This is the first release that contains the fix.
pip install --upgrade "zope2==2.13.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The HTTP header injection vulnerability in Plone and Zope2 can have serious security implications, allowing attackers to manipulate headers and potentially perform various attacks. It is crucial to update to the latest patched versions of Plone and Zope2 to mitigate this vulnerability. By doing so, you ensure that the vulnerable code is replaced with a secure implementation that properly sanitizes HTTP headers. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zope2 →
FAQ
HTTP header injection is a web security vulnerability that allows an attacker to manipulate or inject arbitrary HTTP headers. By injecting malicious headers, an attacker can perform various attacks such as cross-site scripting (XSS), session hijacking, and cache poisoning.
An attacker can exploit the HTTP header injection vulnerability in Plone and Zope2 by injecting a linefeed (LF) character into a header value. This allows them to introduce additional headers or modify existing ones, potentially leading to various attacks.
The consequences of the HTTP header injection vulnerability in Plone and Zope2 can be severe. Attackers can manipulate headers to inject malicious content, bypass security controls, or impersonate legitimate users. This can result in cross-site scripting (XSS) attacks, session hijacking, cache poisoning, and other security breaches.
Plone versions prior to 4.3 beta 1 and Zope2 versions prior to 2.13.19 are affected by the HTTP header injection vulnerability.
To protect your Plone and Zope2 applications from the HTTP header injection vulnerability, it is crucial to update to the latest patched versions. Upgrade to Plone 4.2.3 or later and Zope2 2.13.19 or later to ensure that the vulnerable code is replaced with a secure implementation.
Related vulnerabilities
Recent vulnerabilities recorded for zope2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
