GHSA-vf8g-m3vq-6p4pMediumCVSS 6.1

Plone Cross-site Scripting Vulnerability

Published
May 17, 2022
Last Modified
October 18, 2024

🔗 CVE IDs covered (1)

CVE-2015-7316 →

📋 Description

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into a specially crafted url containing <script, %3Cscript, javascript:, or javascript%3A, Cross-site Scripting can be achieved.

🎯 Affected products6

  • pip/plone:= 5.0rc1
  • pip/Plone:>= 3.3, <= 3.3.6
  • pip/Plone:>= 4.0, <= 4.0.10
  • pip/Plone:>= 4.1, <= 4.1.6
  • pip/Plone:>= 4.2, <= 4.2.7
  • pip/Plone:>= 4.3, < 4.3.7

🔗 References (8)