GitHub Advisoryadvisory · PyPI

GHSA-46f9-f8jm-mw2x Plone Cross-site Scripting vulnerability in the LiveSearch module

MEDIUM Published 2022-05-02 Modified 2024-02-09 Official page ↗
Aliases
CVE-2008-4571
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-09

Affected packages

• PyPI Plone: < 3.0.4 → fixed in 3.0.4

Description

Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.

Related

Alias · CVE (1)

  • CVE-2008-4571 Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References