GitHub Advisoryadvisory · PyPI

GHSA-vf8g-m3vq-6p4p Plone Cross-site Scripting Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-10-18 Official page ↗
Aliases
CVE-2015-7316
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-22

Affected packages

• PyPI Plone: >= 3.3, < 3.3.7 → fixed in 3.3.7 • PyPI Plone: >= 4.0, < 4.0.11 → fixed in 4.0.11 • PyPI Plone: >= 4.1, < 4.1.7 → fixed in 4.1.7 • PyPI Plone: >= 4.2, < 4.2.8 → fixed in 4.2.8 • PyPI Plone: >= 4.3, < 4.3.7 → fixed in 4.3.7 • PyPI Plone: 5.0rc1 (no fix yet)

Description

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into a specially crafted url containing `<script`, `%3Cscript`, `javascript:`, or `javascript%3A`, Cross-site Scripting can be achieved.

Related

Alias · CVE (1)

  • CVE-2015-7316 Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References