Skip to content
Fencer Intel
critical 9.3

CVE-2011-3587 in the critical feed json

Zope Command Execution Vulnerability

published 2011-10-10 15 y ago modified 2026-07-07 4 mo ago also GHSA-8w48-m6hx-rjw2 , PYSEC-2026-1067 , EUVD-2011-0026

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
78.1%
EPSS 78.1% chance of exploitation in 30 days, percentile 99.5%
public exploits
2
Metasploit, Exploit-DB

Summary

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

Patch / fix

  • pypi zope2 2.12.20, 2.13.10

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-3587 updated cvss 6.8

zope: Unspecified vulnerability in Zope v2.12.x and Zope v2.13.x allowing arbitrary code execution

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/plone_popen2)
  2. Published

Exploit prediction

78.08% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected packages

ecosystem package affected fixed in
pypi zope2
>=2.12.0, <2.12.20
>=2.13.0, <2.13.10
2.12.20
2.13.10

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.