CVE-2024-23054
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
An issue in the Plone Docker Official Image 5.2.13 (5221) where a package listed in ++plone++static/components does not exist in the public npm package index, potentially allowing remote code execution.
Risk Assessment
An attacker could exploit the missing npm package to inject malicious code, leading to full server compromise and potential data breach.
Recommendation
Update the Plone Docker image to the latest version and verify that all npm dependencies are available and from trusted sources.
Other vulnerabilities in Plone
See all- CVE-2015-7318High
Plone versions 3.3.0 through 3.3.6 allow remote attackers to inject headers into HTTP responses.
- CVE-2016-4041High
Plone versions 4.0 through 5.1a1 lack security declarations for Dexterity content-related WebDAV requests, allowing remote attackers to gain WebDAV access via unspecified vectors.
- CVE-2012-5493High
In gtbn.py in Plone before 4.2.3 and 4.3 before beta 1, remote authenticated users with certain permissions can bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
- CVE-2012-5487High
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
- CVE-2024-23055Medium
An issue in the official Plone Docker image version 5.2.13 (5221) allows remote code execution due to improper validation of HOST headers.
Original NVD description (English source)
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).