Vulnerability Database

296,746

Total vulnerabilities in the database

CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.

Published: May 22, 2021
Updated: May 9, 2024
CVE: CVE-2021-33509
GHSA: GHSA-hm2p-fhwx-9285
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 8.5
AV:N/AC:M/Au:S/C:C/I:C/A:C

CWEs:

CWE-732

Affected Software
References

Software	From	Fixed in
plone / plone	-	5.2.4.x
plone	-	5.2.5

http://www.openwall.com/lists/oss-security/2021/05/22/1
https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo