Summaryinfo

A vulnerability identified as problematic has been detected in Plone and Zope. This issue affects some unknown processing of the component Pseudo-Random Generator. The manipulation leads to cryptographic issue. This vulnerability is referenced as CVE-2012-6661. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Plone and Zope (Content Management System). This issue affects some unknown functionality of the component Pseudo-Random Generator. The manipulation with an unknown input leads to a cryptographic issue vulnerability. Using CWE to declare the problem leads to CWE-310. Impacted is confidentiality.

The weakness was published 11/03/2014 by Christian Heimes (oss-sec). The advisory is shared at openwall.com. The identification of this vulnerability is CVE-2012-6661 since 11/03/2014. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (98474) and SecurityFocus (BID 70898†). Similar entries are available at VDB-71688 and VDB-72785. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Plone 3.3/4.1/4.2
• Zope 2.10.11/2.11.8/2.12/2.13

Productinfo

Type

• Content Management System

Name

• Plone
• Zope

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion