id: PYSEC-2014-33
details: z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote
  attackers to obtain the default form field values by leveraging knowledge of the
  form location and the element id.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.2.3
    - introduced: 4.3a0
    - fixed: 4.3b1
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2a1
  - 3.2rc1
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - 3.3b1
  - 3.3rc1
  - 3.3rc2
  - 3.3rc3
  - 3.3rc4
  - 3.3rc5
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0rc1
  - "4.1"
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 4.1.5
  - 4.1.6
  - 4.1a1
  - 4.1a2
  - 4.1a3
  - 4.1b1
  - 4.1b2
  - 4.1rc2
  - 4.1rc3
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2a1
  - 4.2a2
  - 4.2b1
  - 4.2b2
  - 4.2rc1
  - 4.2rc2
  - 4.3a1
  - 4.3a2
references:
- type: ADVISORY
  url: https://plone.org/products/plone/security/advisories/20121106/07
- type: WEB
  url: https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2012/11/10/1
- type: WEB
  url: https://plone.org/products/plone-hotfix/releases/20121106
- type: ADVISORY
  url: https://github.com/advisories/GHSA-f8pg-wp5j-rjxx
aliases:
- CVE-2012-5491
- GHSA-f8pg-wp5j-rjxx
modified: "2021-09-01T08:44:29.513262Z"
published: "2014-09-30T14:55:00Z"