CVE-2016-4041
HIGHPlone 4.0-5.1a1 - Unauthenticated Privilege Escalation via WebDAV Requests
Title source: llmDescription
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/04/20/1
Scores
CVSS v3
7.3
EPSS
0.0148
EPSS Percentile
71.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-264
Status
published
Products (41)
plone/plone
4.0
plone/plone
4.0.1
plone/plone
4.0.2
plone/plone
4.0.3
plone/plone
4.0.4
plone/plone
4.0.5
plone/plone
4.0.7
plone/plone
4.0.8
plone/plone
4.0.9
plone/plone
4.0.10
... and 31 more
Published
Feb 24, 2017
Tracked Since
Feb 18, 2026