GitHub Advisoryadvisory · PyPI

GHSA-84jm-cpc5-c7g7 Plone XSS in Zope ZMI

MEDIUM Published 2022-05-17 Modified 2024-10-18 Official page ↗
Aliases
CVE-2016-7147
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-22

Affected packages

• PyPI Plone: >= 4.0, < 4.3.12 → fixed in 4.3.12 • PyPI Plone: >= 5.0, < 5.0.7 → fixed in 5.0.7

Description

Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the `obj_ids:tokens` parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.

Related

Alias · CVE (1)

  • CVE-2016-7147 Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References