PT-2018-5247 · Plone Foundation · Plone

Published 2018-01-03 · Updated 2022-05-14 · CVE-2017-1000482

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1

Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page.

Recommendations For Plone versions 2.5 through 5.1rc1, consider disabling the ability to set JavaScript in the home page property of user profiles until a fix is available. Restrict access to the author page to minimize the risk of exploitation. Avoid using the home page property in user profiles until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000482

GHSA-859J-668V-MRR6

PYSEC-2018-71

Affected Products

Plone

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000482 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000482 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-859j-668v-mrr6 · Vendor Advisory
• https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-71 · Vendor Advisory
• https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab · Note
• https://github.com/plone/Products.CMFPlone/pull/2235 · Note
• https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373 · Note
• https://github.com/plone/Products.CMFPlone/pull/2233 · Note
• https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b · Note
• https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8 · Note
• https://github.com/plone/Products.CMFPlone/pull/2234 · Note
• https://github.com/plone/Products.CMFPlone/pull/2236 · Note
• https://github.com/plone/Products.CMFPlone · Note
• https://github.com/plone/Products.CMFPlone/issues/2232 · Note