CVE-2024-23054

CriticalCVSS 9.8

Published: 05/02/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.28%

66th percentile - higher than 66% of all known CVEs

Summary

An issue in the Plone Docker Official Image 5.2.13 (5221) where a package listed in ++plone++static/components does not exist in the public npm package index, potentially allowing remote code execution.

Risk Assessment

An attacker could exploit the missing npm package to inject malicious code, leading to full server compromise and potential data breach.

Recommendation

Update the Plone Docker image to the latest version and verify that all npm dependencies are available and from trusted sources.

Original NVD description (English source)

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).