GitHub Advisoryadvisory · PyPI

GHSA-chvw-gjxf-f8mc Plone vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-14 Modified 2024-10-18 Official page ↗
Aliases
CVE-2016-7140
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-29

Affected packages

• PyPI Plone: >= 5.0a1, < 5.0.7 → fixed in 5.0.7 • PyPI Plone: >= 3.3a1, < 4.3.12 → fixed in 4.3.12

Description

Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-7140 Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References