PT-2011-3492 · Plone · Plone

Matthew Wilkes · Publicado 2011-06-06 · Atualizado 2018-10-09 · CVE-2011-1949

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1

Description A cross-site scripting (XSS) issue exists in the safe html filter in Products.PortalTransforms, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Recommendations For Plone versions 2.1 through 4.1, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-1949

GHSA-H6HQ-C896-W882

PYSEC-2011-15

Produtos afetados

Plone

Referências · 15

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-15.yaml · Nota
• https://github.com/plone/Plone · Nota
• http://secunia.com/advisories/44776 · Aviso do Fabricante
• https://github.com/advisories/GHSA-h6hq-c896-w882 · Nota
• http://plone.org/products/plone/security/advisories/CVE-2011-1949 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1949 · Nota de Segurança
• http://securityfocus.com/archive/1/518155/100/0/threaded · Nota
• https://osv.dev/vulnerability/PYSEC-2011-15 · Aviso do Fabricante
• http://securityfocus.com/bid/48005 · Nota
• https://osv.dev/vulnerability/GHSA-h6hq-c896-w882 · Aviso do Fabricante
• http://osvdb.org/72728 · Nota
• http://securityreason.com/securityalert/8269 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1949 · Nota
• http://secunia.com/advisories/44775 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67694 · Nota