PT-2017-9094 · Zope · Zope Zmi+1

Published 2017-02-04 · Updated 2022-05-17 · CVE-2016-7147

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.3.12 Plone versions 5.x prior to 5.0.7

Description A cross-site scripting (XSS) issue exists in the manage findResult component of the search feature in Zope ZMI, allowing remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj ids:tokens parameter.

Recommendations For Plone versions prior to 4.3.12, update to version 4.3.12 or later. For Plone versions 5.x prior to 5.0.7, update to version 5.0.7 or later. As a temporary workaround, consider restricting access to the manage findResult component in the search feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-7147

GHSA-84JM-CPC5-C7G7

PYSEC-2017-64

Affected Products

Plone

Zope Zmi

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2016-7147 · Security Note
• https://ubuntu.com/security/CVE-2016-7147 · Vendor Advisory
• https://curesec.com/blog/article/blog/Plone-XSS-186.html · Patch
• https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7147 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7147 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-64 · Vendor Advisory
• https://plone.org/security/hotfix/20170117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7147 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-84jm-cpc5-c7g7 · Vendor Advisory
• https://github.com/zopefoundation/Zope/pull/86/commits/e130ee11fe36255b90c85404520b503e29e16e09 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-64.yaml · Note
• https://github.com/plone/Plone · Note
• https://web.archive.org/web/20170214002551/http://securityfocus.com/bid/96117 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7147 · Note