PT-2010-4006 · Zope · Plone

Published 2010-06-23 · Updated 2022-05-17 · CVE-2010-2422

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 3.3.4 Plone versions 2.1 through 3.3.5 before hotfix 20100612

Description The issue is related to a cross-site scripting (XSS) vulnerability in PortalTransforms. This allows remote attackers to inject arbitrary web script or HTML via the safe html transform.

Recommendations For Plone versions 2.1 through 3.3.4, apply hotfix 20100612 to resolve the issue. For Plone versions 2.1 through 3.3.5 before hotfix 20100612, apply hotfix 20100612 to resolve the issue. As a temporary workaround, consider restricting access to the safe html transform until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2422

GHSA-QJ7X-WM9Q-QJX8

PYSEC-2010-19

Affected Products

Plone

References · 11

• https://osv.dev/vulnerability/PYSEC-2010-19 · Vendor Advisory
• http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2422 · Security Note
• http://secunia.com/advisories/40270 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj7x-wm9q-qjx8 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2010-19.yaml · Note
• https://github.com/plone/Plone · Note
• http://securityfocus.com/bid/40999 · Note
• https://web.archive.org/web/20100728161728/http://secunia.com/advisories/40270 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2422 · Note
• https://web.archive.org/web/20200228223808/http://securityfocus.com/bid/40999 · Note