PT-2014-2329 · Plone Foundation · Plone

Mauro Gentile · Published 2014-09-30 · Updated 2022-05-17 · CVE-2012-5502

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description A cross-site scripting (XSS) issue allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-5502

GHSA-HR59-35CR-QF43

PYSEC-2014-44

Affected Products

Plone

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2012-5502 · Security Note
• https://plone.org/products/plone/security/advisories/20121106/18 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-44 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hr59-35cr-qf43 · Vendor Advisory
• https://plone.org/products/plone-hotfix/releases/20121106 · Patch
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-44.yaml · Note
• https://github.com/plone/Plone · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5502 · Note
• http://openwall.com/lists/oss-security/2012/11/10/1 · Note