PT-2010-4006 · Zope · Plone

Publicado 2010-06-23 · Atualizado 2022-05-17 · CVE-2010-2422

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 3.3.4 Plone versions 2.1 through 3.3.5 before hotfix 20100612

Description The issue is related to a cross-site scripting (XSS) vulnerability in PortalTransforms. This allows remote attackers to inject arbitrary web script or HTML via the safe html transform.

Recommendations For Plone versions 2.1 through 3.3.4, apply hotfix 20100612 to resolve the issue. For Plone versions 2.1 through 3.3.5 before hotfix 20100612, apply hotfix 20100612 to resolve the issue. As a temporary workaround, consider restricting access to the safe html transform until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2422

GHSA-QJ7X-WM9Q-QJX8

PYSEC-2010-19

Produtos afetados

Plone

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2010-19.yaml · Nota
• https://github.com/plone/Plone · Nota
• http://securityfocus.com/bid/40999 · Nota
• https://osv.dev/vulnerability/PYSEC-2010-19 · Aviso do Fabricante
• http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2422 · Nota de Segurança
• https://web.archive.org/web/20100728161728/http://secunia.com/advisories/40270 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2422 · Nota
• http://secunia.com/advisories/40270 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qj7x-wm9q-qjx8 · Aviso do Fabricante
• https://web.archive.org/web/20200228223808/http://securityfocus.com/bid/40999 · Nota