PT-2022-28240 · Unknown+2 · Products.Cmfplone+4
Published
2022-02-01
·
Updated
2022-02-01
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Plone versions prior to 5.2.7
Plone versions prior to 6.0.0a3
plone.app.contenttypes versions prior to 2.2.3
plone.app.contenttypes versions prior to 3.0.0a9
Products.CMFPlone versions in the 4.3 series
Products.ATContentTypes versions in Plone 5.0-5.2
Description
The issue concerns reflected cross-site scripting and open redirect vulnerabilities. An attacker can exploit this by getting a compromised version of the
image view fullscreen page into a cache, such as Varnish, using a technique known as cache poisoning. This can affect later visitors who click on links on the compromised page, typically anonymous users, depending on cache settings.Recommendations
For Plone versions prior to 5.2.7, update to version 5.2.7 or later.
For Plone versions prior to 6.0.0a3, update to version 6.0.0a3 or later.
For plone.app.contenttypes versions prior to 2.2.3, update to version 2.2.3 or later.
For plone.app.contenttypes versions prior to 3.0.0a9, update to version 3.0.0a9 or later.
For Products.CMFPlone versions in the 4.3 series and Products.ATContentTypes versions in Plone 5.0-5.2, consider the workaround: remove
image view fullscreen from the 'Legacy template mappings' in the 'Caching operations' control panel to prevent it from being stored in the cache.
As a temporary workaround for all unpatched versions, ensure the image view fullscreen page is not stored in the cache by following the steps outlined in the workaround section.Fix
Open Redirect
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Plone
Products.Atcontenttypes
Products.Cmfplone
Varnish
Plone.App.Contenttypes