CVE-2024-22889 PoC — Plone 安全漏洞

Source

https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9

Associated Vulnerability

Title:Plone 安全漏洞 (CVE-2024-22889)
Description:Plone是一套基于Zope应用服务器构建的开源内容管理系统（CMS）。 Plone v6.0.9版本存在安全漏洞，该漏洞源于访问控制不当，导致攻击者可以通过发送特制的请求来查看和列举网站上托管的所有文件。

Readme

Product: Plone CMS 

Version: v6.0.9 

Date found: 10.01.2024. 

Date reported: 10.01.2024. 

Vulnerability type: Incorrect Access Control. 

CVE ID: CVE-2024-22889 

Description: Due to incorect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

POC is coming soon:)

File Snapshot


 [4.0K]  /data/pocs/2107e9c43417322332e71a9915de470ecd55dca6
├── [ 350]  CVE-2024-22889
└── [ 356]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!