CVE-2011-3587

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 78.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-10-10 · updated 2026-06-16

Description

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Affected products

Plone CMS: 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+8)
zopefoundation Zope: 2.12.0, 2.12.0-a1, 2.12.0-a2, 2.12.0-a3, 2.12.0-a4, 2.12.0-b1 (+40)

References

http://plone.org/products/plone-hotfix/releases/20110928
http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip
http://plone.org/products/plone/security/advisories/20110928
http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0
http://secunia.com/advisories/46221
http://secunia.com/advisories/46323
http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587
https://bugzilla.redhat.com/show_bug.cgi?id=742297
http://plone.org/products/plone-hotfix/releases/20110928
http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip
http://plone.org/products/plone/security/advisories/20110928
http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0

Get alerted when CVE-2011-3587 or the next vulnerability affects your stack