CVE-2012-5493: gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissi...

Security readout for executives and security teams

CVE-2012-5493 is a Plone sandbox bypass that could let a logged-in user with specific permissions run arbitrary Python code. That can turn a content-management permission issue into server-side code execution. The public bundle does not identify active exploitation. Likely exposure is limited to older Plone deployments before 4.2.3 or 4.3 beta 1, especially where untrusted authenticated users have elevated content or site-management permissions. The source bundle does not provide CPEs, exact vulnerable configurations, or role names. Prioritize remediation for any internet-facing or multi-user Plone site still on affected versions. Although exploitation evidence is not supplied, sandbox bypass with arbitrary Python execution is a high-impact condition and old Plone instances may be overlooked in asset inventories. Mitigation focus: Upgrade Plone to 4.2.3, 4.3 beta 1, or a later supported release.; Apply the Plone 20121106 hotfix if upgrade is not immediately possible.; Review Plone vendor advisory 20121106/09 for deployment-specific guidance..

Prepared

Jun 14, 2026, 06:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.