@media(max-width:760px){.site-header{position:static;height:auto}.nav-shell{flex-wrap:wrap;height:auto;padding:12px 0}.nav-toggle{display:none}.nav-panel{position:static;display:flex;flex:0 0 100%;padding:10px 0 0;border:0;box-shadow:none}.nav-links a{min-height:42px}}

Public exploit · Metasploit Module

Plone and Zope XMLTools Remote Command Execution

Published 04 October 2011Rocco Calvi

Exploit summary

A vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Source & references

Rapid7 Module