CVE-2016-4041 - Vulnerability Details

Vendors	Products
Plone	Plone

Link	Providers
http://www.openwall.com/lists/oss-security/2016/04/20/1
https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-04-19T00:00:00", "descriptions": [{"lang": "en", "value": "Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-02-24T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"}, {"name": "[oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-4041", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav", "refsource": "CONFIRM", "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"}, {"name": "[oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:17:30.875Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"}, {"name": "[oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-4041", "datePublished": "2017-02-24T20:00:00", "dateReserved": "2016-04-19T00:00:00", "dateUpdated": "2024-08-06T00:17:30.875Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-04-19T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-02-24T19:57:01 (string)

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

}

1 : { »

name : [oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/04/20/1 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve@mitre.org (string)

ID : CVE-2016-4041 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

refsource : CONFIRM (string)

url : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

}

1 : { »

name : [oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/04/20/1 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-06T00:17:30.875Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

}

1 : { »

name : [oss-security] 20160419 Re: CVE Request: Privilege escalation in webdav - Plone (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/04/20/1 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

cveId : CVE-2016-4041 (string)

datePublished : 2017-02-24T20:00:00 (string)

dateReserved : 2016-04-19T00:00:00 (string)

dateUpdated : 2024-08-06T00:17:30.875Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E08F4534-A588-463F-A745-39E559AB1CB8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "B64341BA-5722-415E-9771-9837168AB7C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E2929227-AE19-428D-9AC3-D312A559039B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "3B6DC866-0FEE-475B-855C-A69E004810CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "50BF3E8E-152C-4E89-BAA2-A952D10F4611", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "F1F88BF6-9058-4CB8-A2D6-5653860CF489", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "B2AA3FA2-15C3-444A-8810-5EF3E0E84D58", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "72F3B15A-CD0F-4CC5-A76F-E62637B30E2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "D913FCA7-4DAE-4E9A-9146-9AFA8472B04B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "7C44B53B-953B-4522-A5B4-11573850D2CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "D8883023-113A-420A-97B6-A4A9B29CF7DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "4DF4D113-8D9D-4DA3-A177-64783352F608", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "28F9B699-D1A4-425C-84ED-6A8FD29BE7F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "47321B60-67DA-4543-B173-D629A9569B45", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "58B36EB2-723F-4E25-8018-EEB2BE806D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "7962EF74-6AC1-424C-A202-163AFDADA971", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*", "matchCriteriaId": "1F1818BB-E23A-4136-898D-1D0C80C08728", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "5CB06627-133A-40D1-8816-E31E0A9BAD22", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "AE7E448A-2C0C-4DE0-89EA-904718CB6C6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "6E727C5C-9E54-49F7-B92C-2492069AAE08", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "BFD68465-4CDC-4788-8932-41335B5C4AC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "A7B739E0-FB73-401C-AB1A-E3C1434AA2A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "DCC8B987-5173-4C61-8DE6-B70C18EE6FD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "38BA31E8-77EC-478B-BC6E-E2F145A8B9BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*", "matchCriteriaId": "CE168A35-1A46-4A6F-8A08-25CDD886066D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "CFE0FC06-369B-46CF-9B1E-BAF7AF87E950", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "56571585-E9A2-4B78-B2B1-5D8EADED522A", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "2CDF8A15-401C-453E-8D09-8D4CDD4766DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "39B0B1CE-C0D9-495C-B4E7-E52A50BD6D97", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "043B3CBE-DEA2-474D-AA57-1830A470B621", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "08A6842B-B479-4D91-928A-1CCE1DCB936E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "875A368A-F1D6-4795-99CF-A96DBCD1D407", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "B5962C24-BC35-4E27-B81B-E2D21F83FB13", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "55BCE259-700F-4E39-8565-99E4DFDA6F9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "E8C6DFBF-5CC6-49A7-BC83-E8F686815F6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:*", "matchCriteriaId": "E3642637-8B6D-40A0-9A60-EACE70BB0490", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "8AF9FB6C-134F-4653-8771-1BF46AB39344", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "E22BA768-96DE-408F-8979-4CC58B50A09C", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "1672268D-2EFB-4D9E-99D4-AAEFEA659091", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "9EF74DD4-27BB-4881-B324-B53336EF0648", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "1C6962EC-8398-4564-9840-AECB3E3D697D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "ADE89FE6-DBF6-4CDD-BBA3-B34AEEAE6BA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "83D341D6-AB11-444F-88FD-22303D1E3F65", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors."}, {"lang": "es", "value": "Plone 4.0 hasta la versi\u00f3n 5.1a1 no tiene declaraciones de seguridad para solicitudes de WebDAV relacionadas con contenido de Dexterity, lo que permite a atacantes remotos obtener acceso webdav a trav\u00e9s de vectores no especificados."}], "id": "CVE-2016-4041", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-24T20:59:00.283", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : E08F4534-A588-463F-A745-39E559AB1CB8 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : B64341BA-5722-415E-9771-9837168AB7C0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : E2929227-AE19-428D-9AC3-D312A559039B (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B6DC866-0FEE-475B-855C-A69E004810CD (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 50BF3E8E-152C-4E89-BAA2-A952D10F4611 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:* (string)

matchCriteriaId : F1F88BF6-9058-4CB8-A2D6-5653860CF489 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:* (string)

matchCriteriaId : B2AA3FA2-15C3-444A-8810-5EF3E0E84D58 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:* (string)

matchCriteriaId : 72F3B15A-CD0F-4CC5-A76F-E62637B30E2E (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:* (string)

matchCriteriaId : D913FCA7-4DAE-4E9A-9146-9AFA8472B04B (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 7C44B53B-953B-4522-A5B4-11573850D2CD (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : D8883023-113A-420A-97B6-A4A9B29CF7DB (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 4DF4D113-8D9D-4DA3-A177-64783352F608 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 28F9B699-D1A4-425C-84ED-6A8FD29BE7F8 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 47321B60-67DA-4543-B173-D629A9569B45 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 58B36EB2-723F-4E25-8018-EEB2BE806D9D (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 7962EF74-6AC1-424C-A202-163AFDADA971 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 1F1818BB-E23A-4136-898D-1D0C80C08728 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 5CB06627-133A-40D1-8816-E31E0A9BAD22 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:* (string)

matchCriteriaId : AE7E448A-2C0C-4DE0-89EA-904718CB6C6D (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 6E727C5C-9E54-49F7-B92C-2492069AAE08 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:* (string)

matchCriteriaId : BFD68465-4CDC-4788-8932-41335B5C4AC8 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:* (string)

matchCriteriaId : A7B739E0-FB73-401C-AB1A-E3C1434AA2A3 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:* (string)

matchCriteriaId : DCC8B987-5173-4C61-8DE6-B70C18EE6FD3 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 38BA31E8-77EC-478B-BC6E-E2F145A8B9BD (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* (string)

matchCriteriaId : CE168A35-1A46-4A6F-8A08-25CDD886066D (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : CFE0FC06-369B-46CF-9B1E-BAF7AF87E950 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 56571585-E9A2-4B78-B2B1-5D8EADED522A (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 2CDF8A15-401C-453E-8D09-8D4CDD4766DB (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 39B0B1CE-C0D9-495C-B4E7-E52A50BD6D97 (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 043B3CBE-DEA2-474D-AA57-1830A470B621 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 08A6842B-B479-4D91-928A-1CCE1DCB936E (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 875A368A-F1D6-4795-99CF-A96DBCD1D407 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:* (string)

matchCriteriaId : B5962C24-BC35-4E27-B81B-E2D21F83FB13 (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:* (string)

matchCriteriaId : 55BCE259-700F-4E39-8565-99E4DFDA6F9E (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:* (string)

matchCriteriaId : E8C6DFBF-5CC6-49A7-BC83-E8F686815F6A (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:* (string)

matchCriteriaId : E3642637-8B6D-40A0-9A60-EACE70BB0490 (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:* (string)

matchCriteriaId : 8AF9FB6C-134F-4653-8771-1BF46AB39344 (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:* (string)

matchCriteriaId : E22BA768-96DE-408F-8979-4CC58B50A09C (string)

vulnerable : true (boolean)

}

39 : { »

criteria : cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:* (string)

matchCriteriaId : 1672268D-2EFB-4D9E-99D4-AAEFEA659091 (string)

vulnerable : true (boolean)

}

40 : { »

criteria : cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 9EF74DD4-27BB-4881-B324-B53336EF0648 (string)

vulnerable : true (boolean)

}

41 : { »

criteria : cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 1C6962EC-8398-4564-9840-AECB3E3D697D (string)

vulnerable : true (boolean)

}

42 : { »

criteria : cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : ADE89FE6-DBF6-4CDD-BBA3-B34AEEAE6BA5 (string)

vulnerable : true (boolean)

}

43 : { »

criteria : cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 83D341D6-AB11-444F-88FD-22303D1E3F65 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. (string)

}

1 : { »

lang : es (string)

value : Plone 4.0 hasta la versión 5.1a1 no tiene declaraciones de seguridad para solicitudes de WebDAV relacionadas con contenido de Dexterity, lo que permite a atacantes remotos obtener acceso webdav a través de vectores no especificados. (string)

}

]

id : CVE-2016-4041 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : true (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 7.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-02-24T20:59:00.283 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/04/20/1 (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/04/20/1 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-264 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object