What is GHSA-p7h9-vf92-5fj5?

GHSA-p7h9-vf92-5fj5 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Which CVE IDs does GHSA-p7h9-vf92-5fj5 cover?

GHSA-p7h9-vf92-5fj5 covers the following CVE IDs: CVE-2011-1948. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p7h9-vf92-5fj5?

GHSA-p7h9-vf92-5fj5 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-p7h9-vf92-5fj5?

GHSA-p7h9-vf92-5fj5 affects 4 products, including: pip/Products.PasswordResetTool:\u003c 2.0.6; pip/Products.CMFPlone:\u003c 4.0.7; pip/Products.CMFPlone:\u003e= 4.1a1, \u003c= 4.1rc2; pip/Plone:\u003e= 0, \u003c 4.1.1.

GHSA-p7h9-vf92-5fj5MediumCVSS 6.1

Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Vendor

GitHub Security Advisories

Published

July 23, 2018

Last Modified

October 14, 2024

🔗 CVE IDs covered (1)

CVE-2011-1948 →

📋 Description

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

🎯 Affected products4

pip/Products.PasswordResetTool:< 2.0.6
pip/Products.CMFPlone:< 4.0.7
pip/Products.CMFPlone:>= 4.1a1, <= 4.1rc2
pip/Plone:>= 0, < 4.1.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2011-1948
https://exchange.xforce.ibmcloud.com/vulnerabilities/67693
https://github.com/advisories/GHSA-p7h9-vf92-5fj5
http://plone.org/products/plone/security/advisories/CVE-2011-1948
https://access.redhat.com/errata/RHSA-2012:0151
https://access.redhat.com/security/cve/CVE-2011-1948
https://bugzilla.redhat.com/show_bug.cgi?id=711494
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-14.yaml