GitHub Advisoryadvisory · PyPI

GHSA-pp4c-2692-7f37 Plone Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-14 Modified 2024-10-15 Official page ↗
Aliases
CVE-2016-7139
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-29

Affected packages

• PyPI Plone: >= 5.0, < 5.0.6 → fixed in 5.0.6 • PyPI Plone: >= 4.0a1, < 4.3.12 → fixed in 4.3.12 • PyPI Plone: >= 3.3, <= 3.3.6 (no fix yet)

Description

Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Related

Alias · CVE (1)

  • CVE-2016-7139 Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References