The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NPlone
APPPlone5.2.13
Related vulnerabilities
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to ...
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password fo...
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwri...
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted o...
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1,...