PT-2014-2329 · Plone Foundation · Plone

Mauro Gentile · Publicado 2014-09-30 · Atualizado 2022-05-17 · CVE-2012-5502

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description A cross-site scripting (XSS) issue allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-5502

GHSA-HR59-35CR-QF43

PYSEC-2014-44

Produtos afetados

Plone

Referências · 10

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-44.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5502 · Nota de Segurança
• https://plone.org/products/plone/security/advisories/20121106/18 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-44 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5502 · Nota
• https://osv.dev/vulnerability/GHSA-hr59-35cr-qf43 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/11/10/1 · Nota
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção