GitHub Advisoryadvisory · PyPI
GHSA-v3hp-f8qr-cf3p Plone XSS
MEDIUM
Official page ↗
- Aliases
- CVE-2016-7138
- Ecosystem
- PyPI
- Packages
- Plone
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-07-31
Affected packages
• PyPI Plone: >= 5.0.0, <= 5.0.6 (no fix yet)
• PyPI Plone: >= 4.0.0, <= 4.3.11 (no fix yet)
• PyPI Plone: >= 3.3.0, <= 3.3.6 (no fix yet)
Description
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Related
Alias · CVE (1)
- CVE-2016-7138 Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-7138 advisory
- https://github.com/plone/Plone package
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-61.yaml web
- https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1 web
- https://web.archive.org/web/20210625091607/http://www.securityfocus.com/bid/92752 web
- https://web.archive.org/web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded web
- http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html web
- http://seclists.org/fulldisclosure/2016/Oct/80 web
- http://www.openwall.com/lists/oss-security/2016/09/05/4 web
- http://www.openwall.com/lists/oss-security/2016/09/05/5 web
- http://www.securityfocus.com/archive/1/539572/100/0/threaded web
- http://www.securityfocus.com/bid/92752 web