GitHub Advisoryadvisory · PyPI

GHSA-cvwc-g7fw-7xrj Plone XSS Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-1340
Ecosystem
PyPI
Packages
plone
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-19

Affected packages

• PyPI plone: < 2.5.3 → fixed in 2.5.3

Description

Cross-site scripting (XSS) vulnerability in `skins/plone_templates/default_error_message.pt` in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to `Members/ipa/createObject`.

Related

Alias · CVE (1)

  • CVE-2011-1340 Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References