The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| Plone(PyPI) | 4.0 | 4.0.10 | N/A |
| Plone(PyPI) | 4.1 | 4.1.1 | N/A |
| Plone(PyPI) | 4.2a1 | 4.2a3 | N/A |
CVSS Metrics
