CVE-2012-5500

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request. This is possible due to a flaw in the batch id change script, specifically the renameObjectsByPaths.py script.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later. As a temporary workaround, consider restricting access to the renameObjectsByPaths.py script until a patch is available.