GitHub Advisoryadvisory · PyPI

GHSA-4793-w44w-m7xm Plone Zope cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-05 Modified 2024-10-18 Official page ↗
Aliases
CVE-2013-7062
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-28

Affected packages

• PyPI Plone: >= 3.3, < 3.3.6 → fixed in 3.3.6 • PyPI Plone: >= 4.0, < 4.0.9 → fixed in 4.0.9 • PyPI Plone: >= 4.1, < 4.1.6 → fixed in 4.1.6 • PyPI Plone: >= 4.3, < 4.3.2 → fixed in 4.3.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.

Related

Alias · CVE (1)

  • CVE-2013-7062 Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References