CVE-2020-7938

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
https://plone.org/security/hotfix/20200121Vendor Advisory
https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installedVendor Advisory
https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
https://plone.org/security/hotfix/20200121Vendor Advisory
https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installedVendor Advisory
https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory

Timeline

Published: Jan 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79398.8SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem i CVE-2020-79407.5Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.CVE-2020-79419.8A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needi CVE-2020-79426.5Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom CVE-2020-79437.5Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may conta CVE-2020-79447.7In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resul CVE-2020-79455.5Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who shou CVE-2020-79479.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled CVE-2020-79488.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.CVE-2020-79497.8schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se CVE-2020-79507.8meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming serv CVE-2020-79517.8meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming serv