Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0394 advisory.

    [0.12.2-24.0.1.el5_6.1]
    - Added conga-enterprise.patch
    - Added conga-enterprise-Carthage.patch to support OEL5
    - Recreated Data.fs  in luci_db.tar.gz
    - Replaced redhat logo image in conga-0.12.2.tar.gz

    [0.12.2-24.1]
    - Fix bz680515 (CVE-2011-0720 plone: unauthorized remote administrative access)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated conga packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The conga packages provide a web-based administration tool for remote cluster and storage management.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

Users of Conga are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, luci must be restarted ('service luci restart') for the update to take effect.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

The conga packages provide a web-based administration tool for remote cluster and storage management.

A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to read, create, or modify the content of the luci application. (CVE-2011-0720)

Users of Conga are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, luci must be restarted ('service luci restart') for the update to take effect.

SL 4x

Plone developer reports :

This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still in place, and it does not grant access to other applications running on the same Zope instance.

The version of Plone on the remote host fails to require authentication to access several sensitive functions.

Plone is built on top of Zope, which maps Python objects and their methods to URLs.  Methods can have security restrictions, such as requiring a login account or a specific privilege level, applied to them to limit access.  The installed version of Plone permits access to several methods that allow the adding, deleting, and changing content and users.

ID	Name	Product	Family	Severity
68240	Oracle Linux 5 : conga (ELSA-2011-0394)	Nessus	Oracle Linux Local Security Checks	high
63975	RHEL 5 : conga (RHSA-2011:0394)	Nessus	Red Hat Local Security Checks	high
60997	Scientific Linux Security Update : conga on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60996	Scientific Linux Security Update : conga on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56079	FreeBSD : plone -- Remote Security Bypass (7c492ea2-3566-11e0-8e81-0022190034c0)	Nessus	FreeBSD Local Security Checks	high
53546	Plone Security Bypass	Nessus	CGI abuses	high
53504	CentOS 5 : conga (CESA-2011:0394)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2011-0720

high

Tenable Plugins

high

high

high

high

high

high

high