-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Zope's publishing mechanism where methods with docstrings become web-accessible. The commit zopefoundation/Products.CMFCore@e1d981b explicitly removes the docstring from addMember to prevent publication. This aligns with CWE-284 (Improper Access Control) as the method was exposed without proper authorization checks. The patches in Products.CMFPlone and Products.CMFCore address this by making addMember non-publishable, confirming this function's role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Products.CMFPlone | pip | >= 3.3.0, < 4.3.6 | 4.3.7 |
| Products.CMFPlone | pip | >= 5.0a1, < 5.0rc2 | 5.0rc2 |
| Plone | pip | >= 3.3, <= 3.3.6 | |
| Plone | pip | >= 4.0a1, <= 4.0.10 | |
| Plone | pip | >= 4.1a1, <= 4.1.6 | |
| Plone | pip | >= 4.2a1, <= 4.2.7 | |
| Plone | pip | >= 4.3a1, <= 4.3.6 | |
| Plone | pip | = 5.0rc1 |