id: PYSEC-2011-13
details: Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci,
  and possibly other products, allows remote attackers to obtain administrative access,
  read or create arbitrary content, and change the site skin via unknown vectors.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.0.1
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2a1
  - 3.2rc1
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - 3.3b1
  - 3.3rc1
  - 3.3rc2
  - 3.3rc3
  - 3.3rc4
  - 3.3rc5
  - "4.0"
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0rc1
references:
- type: ADVISORY
  url: http://secunia.com/advisories/43146
- type: WEB
  url: http://www.securityfocus.com/bid/46102
- type: ADVISORY
  url: http://plone.org/products/plone/security/advisories/cve-2011-0720
- type: WEB
  url: http://osvdb.org/70753
- type: WEB
  url: http://www.redhat.com/support/errata/RHSA-2011-0394.html
- type: WEB
  url: http://www.redhat.com/support/errata/RHSA-2011-0393.html
- type: ADVISORY
  url: http://www.vupen.com/english/advisories/2011/0796
- type: ADVISORY
  url: http://secunia.com/advisories/43914
- type: WEB
  url: http://www.securitytracker.com/id?1025258
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/65099
- type: ADVISORY
  url: https://github.com/advisories/GHSA-3v28-9jjp-4g5w
aliases:
- CVE-2011-0720
- GHSA-3v28-9jjp-4g5w
modified: "2021-07-25T23:34:43.059075Z"
published: "2011-02-03T17:00:00Z"