Cyber Resilience

CVE-2024-22889

High

Published: 06 March 2024

Published
06 March 2024
Modified
21 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0055 68.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22889 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Plone Plone. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

CWE(s)
CWE-276

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Incorrect access control in Plone CMS enables remote exploitation of a public-facing application (T1190), arbitrary file and directory listing/viewing (T1083), and facilitates discovery of unsecured credentials in accessible files (T1552.001).

Affected Assets

plone
plone
6.0.9

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-276

Access control policy can specify and enforce secure default permissions for resources.

AC-6 Least Privilege
addresses: CWE-276

Guides setting of default permissions to the minimum required level.

CM-1 Policy and Procedures
addresses: CWE-276

Establishes requirements for appropriate default permissions on system resources as part of configuration management.

CM-2 Baseline Configuration
addresses: CWE-276

Baseline establishment and updates on install/upgrade ensure correct default permissions rather than insecure ones.

CM-6 Configuration Settings
addresses: CWE-276

Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.

CM-9 Configuration Management Plan
addresses: CWE-276

Requires documented processes that include setting and maintaining correct default permissions for configuration items.

PE-1 Policy and Procedures
addresses: CWE-276

Requires addressing secure default permissions in physical and environmental protection controls.

PL-11 Baseline Tailoring
addresses: CWE-276

Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.

References