On behalf of the Plone/Zope Security Team I announce two vulnerability fixes in plone.restapi.
- Unauthenticated Reflective Method Invocation via the REST API @search metadata_fields Parameter, severity 6.5 moderate
- Information disclosure due to wrong permission check, severity 5.3 moderate
Related to the second one is a fix in plone.autoform, but this is not really a security fix, as there is no known exploit. It is just hardening against possible programmer error. I will add it to the version numbers below and recommend it, but it is optional.
You should update your Plone sites to the following versions (formatted as pip constraints here):
For Plone 6.2:
plone.autoform==3.0.1
plone.restapi==10.0.4
For Plone 6.0 and 6.1:
plone.autoform==2.0.5
plone.restapi==9.15.7
(If you are still on Plone 5.2 with Python 3.8, you can also upgrade to plone.restapi 9.15.7.)
If you think a security issue was incompletely solved, please contact the Plone/Zope Security Team via email at security@plone.org.
If these versions cause other problems, you can comment below, or open an issue in the Products.CMFPlone tracker. Please check if anything was reported already.