CVE-2020-7941

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
https://plone.org/security/hotfix/20200121Vendor Advisory
https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-contentVendor Advisory
https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
https://plone.org/security/hotfix/20200121Vendor Advisory
https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-contentVendor Advisory
https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory

Timeline

Published: Jan 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79426.5Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom CVE-2020-79437.5Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may conta CVE-2020-79447.7In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resul CVE-2020-79455.5Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who shou CVE-2020-79479.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled CVE-2020-79488.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.CVE-2020-79497.8schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se CVE-2020-79507.8meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming serv CVE-2020-79517.8meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming serv CVE-2020-79527.8rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming CVE-2020-79537.5An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to th CVE-2020-79547.8An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation thr