GitHub Advisoryadvisory · PyPI

GHSA-89rq-27xp-vgv7 Plone vulnerable to cross-site scripting

MEDIUM Published 2022-05-17 Modified 2025-04-13 Official page ↗
Aliases
CVE-2013-4190
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-29

Affected packages

• PyPI Plone: >= 2.1, < 4.1.1 → fixed in 4.1.1 • PyPI Plone: >= 4.2, < 4.2.6 → fixed in 4.2.6 • PyPI Plone: >= 4.3, < 4.3.2 → fixed in 4.3.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2013-4190 Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References