CVE-2012-5489: The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11,...

Security readout for executives and security teams

This flaw affects older Zope and Plone deployments. An authenticated remote user could access attributes that should be restricted, creating a risk of unauthorized data exposure or permission bypass inside the application. The public bundle does not provide CVSS, affected CPEs, or detailed vectors. Exposure is most likely in legacy Plone or Zope 2 installations that still allow authenticated user access, especially internet-facing portals with many user accounts. The provided affected data is sparse, so inventory should confirm actual Zope and Plone versions. Prioritize if legacy Plone or Zope remains in production, particularly on public portals with external accounts. The issue is old and authenticated, but affected systems are likely unsupported and may carry additional unpatched risk. Mitigation focus: Upgrade Zope to 2.12.21 or 2.13.11 or later where applicable.; Upgrade Plone to 4.2.3 or a fixed 4.3 release where applicable.; Apply the Plone 20121106 hotfix if still on affected supported branches..

Prepared

Jun 14, 2026, 06:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.