PT-2018-5247 · Plone Foundation · Plone

Publicado 2018-01-03 · Atualizado 2022-05-14 · CVE-2017-1000482

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1

Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page.

Recommendations For Plone versions 2.5 through 5.1rc1, consider disabling the ability to set JavaScript in the home page property of user profiles until a fix is available. Restrict access to the author page to minimize the risk of exploitation. Avoid using the home page property in user profiles until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000482

GHSA-859J-668V-MRR6

PYSEC-2018-71

Produtos afetados

Plone

Referências · 17

• https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab · Nota
• https://github.com/plone/Products.CMFPlone/pull/2235 · Nota
• https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373 · Nota
• https://github.com/plone/Products.CMFPlone/pull/2233 · Nota
• https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b · Nota
• https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8 · Nota
• https://github.com/plone/Products.CMFPlone/pull/2234 · Nota
• https://github.com/plone/Products.CMFPlone/pull/2236 · Nota
• https://github.com/plone/Products.CMFPlone · Nota
• https://github.com/plone/Products.CMFPlone/issues/2232 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000482 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000482 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-859j-668v-mrr6 · Aviso do Fabricante
• https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property · Aviso do Fabricante