CVE-2020-7938

Vulnerability

Overview

CVE-2020-7938 is a privilege escalation vulnerability in the plone.restapi package used by Plone 5.2.0 through 5.2.1. The bug resides in the @sharing endpoint, which did not sufficiently restrict the roles a user could delegate during sharing operations. Because the endpoint allowed users to assign roles beyond those they were permitted to delegate, an authenticated user with limited privileges could escalate their own permissions to the highest level available in Plone [1][2][4].

Attack

Vector and Requirements

An attacker must be an authenticated user of a Plone site running the affected versions with plone.restapi installed. No other special network position is required; the exploitation is performed through normal HTTP requests to the @sharing REST API endpoint. The vulnerability was reported independently by Lukas Graf and Niklaus Johner, who also contributed the fix [2][3].

Impact

A successful exploitation allows an attacker to achieve full administrative control over the Plone instance, performing any action the highest-privileged user could. This includes modifying content, altering site configuration, and accessing sensitive data [2].

Mitigation

The Plone project released a security hotfix on 21 January 2020 (PloneHotfix20200121) that addresses this issue along with several others. The fix limits the roles available in the sharing endpoint to only those the current user is legitimately allowed to delegate [2][4]. Users are strongly advised to apply the hotfix or upgrade to a patched version.