GitHub Advisoryadvisory · PyPI

GHSA-hprr-4vfq-fcxw Plone XSS in User Fullname Property and File Upload

MEDIUM Published 2022-05-24 Modified 2024-10-15 Official page ↗
Aliases
CVE-2021-3313
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-22

Affected packages

• PyPI Plone: < 5.2.4 → fixed in 5.2.4

Description

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.

Related

Alias · CVE (1)

  • CVE-2021-3313 Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References