PT-2017-9094 · Zope · Zope Zmi+1

Publicado 2017-02-04 · Atualizado 2022-05-17 · CVE-2016-7147

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.3.12 Plone versions 5.x prior to 5.0.7

Description A cross-site scripting (XSS) issue exists in the manage findResult component of the search feature in Zope ZMI, allowing remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj ids:tokens parameter.

Recommendations For Plone versions prior to 4.3.12, update to version 4.3.12 or later. For Plone versions 5.x prior to 5.0.7, update to version 5.0.7 or later. As a temporary workaround, consider restricting access to the manage findResult component in the search feature to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-7147

GHSA-84JM-CPC5-C7G7

PYSEC-2017-64

Produtos afetados

Plone

Zope Zmi

Referências · 17

• https://github.com/zopefoundation/Zope/pull/86/commits/e130ee11fe36255b90c85404520b503e29e16e09 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-64.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://web.archive.org/web/20170214002551/http://securityfocus.com/bid/96117 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7147 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-7147 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7147 · Nota
• https://curesec.com/blog/article/blog/Plone-XSS-186.html · Correção
• https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2 · Aviso do Fabricante
• http://curesec.com/blog/article/blog/Plone-XSS-186.html · Nota
• https://cve.org/CVERecord?id=CVE-2016-7147 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7147 · Aviso do Fabricante
• http://securityfocus.com/bid/96117 · Nota
• https://osv.dev/vulnerability/PYSEC-2017-64 · Aviso do Fabricante
• https://plone.org/security/hotfix/20170117 · Aviso do Fabricante