CVE-2024-22889

—

CVSS 3.1

7.5 high

EPSS

<1%p51

Published

Mar 6, 2024 (Mar 6, 2024)

Modified

Jun 17, 2026

Description

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

Vendors: plone
Products: plone
Weakness: CWE-276
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.