PyPI/plone CVE-2016-7139: unknown, EPSS 1.59%
Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web scr
Action: Upgrade plone to 4.0a1 or later.
pip install plone==5.0.7pip install plone==4.3.12pip install plone==4.0a1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.3 | 4.0a1 | - |
| 4.0 | 4.3.12 | - |
| 5.0 | 5.0.7 | - |
Fixed versions
| 5.0.7 | 4.3.12 | 4.0a1 |
Sources
- osv: PYSEC-2017-62
- https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone
- http://www.openwall.com/lists/oss-security/2016/09/05/5
- http://www.openwall.com/lists/oss-security/2016/09/05/4
- http://seclists.org/fulldisclosure/2016/Oct/80
- http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
- http://www.securityfocus.com/bid/92752
- http://www.securityfocus.com/archive/1/539572/100/0/threaded
- https://github.com/advisories/GHSA-pp4c-2692-7f37
CVE-2016-7139 · published · modified · JSON