PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4041 Plone CVE debrief

CVE-2016-4041 is a Plone access-control flaw affecting Dexterity content-related WebDAV requests. The issue was publicly discussed in April 2016 and later published as a CVE in February 2017. NVD rates it HIGH (CVSS 7.3) with network access, no authentication, and impacts to confidentiality, integrity, and availability. Plone operators should treat this as a priority hardening item: apply the vendor hotfix/advisory guidance, verify whether WebDAV is needed, and confirm that affected Plone deployments are covered by the fix or mitigation path described by the vendor.

Vendor
Plone
Product
CVE-2016-4041
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Plone administrators, platform owners, and security teams operating deployments that use Dexterity content and WebDAV. It is especially relevant for internet-facing Plone sites or any environment where WebDAV is enabled and not tightly restricted.

Technical summary

The vulnerability is described as missing security declarations for Dexterity content-related WebDAV requests, which can allow a remote attacker to gain WebDAV access via unspecified vectors. NVD maps the weakness to CWE-264 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating a remotely reachable access-control issue with no required privileges or user interaction. The CVE description states affected Plone versions span 4.0 through 5.1a1, while NVD’s CPE criteria explicitly enumerate affected 4.x releases and 5.0 prerelease/release entries through 5.0.4.

Defensive priority

High

Recommended defensive actions

  • Follow the vendor advisory/hotfix guidance for CVE-2016-4041 and verify that the deployed Plone version is covered by the remediation.
  • If WebDAV is not required, disable or restrict it at the application or reverse-proxy layer.
  • Review access controls for Dexterity content-related WebDAV handling and validate that anonymous remote requests cannot reach privileged WebDAV functionality.
  • Inventory all Plone instances, especially internet-facing ones, and confirm they are patched or otherwise mitigated.
  • Monitor for unexpected WebDAV activity and verify logs around the April 2016 disclosure window and any later remediation changes.

Evidence notes

Supported by the CVE description and NVD record: Plone 4.0 through 5.1a1 lacks security declarations for Dexterity content-related WebDAV requests, allowing remote attackers to gain WebDAV access. NVD classifies the issue as CWE-264 and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Public references include the OSS-Security mailing list disclosure and the Plone security hotfix advisory.

Official resources

Publicly disclosed in April 2016 via the Plone security advisory/hotfix reference and the OSS-Security mailing-list post; the CVE record was published by NVD on 2017-02-24.