PyPI/plone CVE-2016-7140: unknown, EPSS 1.59%
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web
Action: Upgrade plone to 4.0a1 or later.
pip install plone==5.0.7pip install plone==4.3.12pip install plone==4.0a1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.3 | 4.0a1 | - |
| 4.0 | 4.3.12 | - |
| 5.0 | 5.0.7 | - |
Fixed versions
| 5.0.7 | 4.3.12 | 4.0a1 |
Sources
- osv: PYSEC-2017-63
- https://plone.org/security/hotfix/20160830/non-persistent-xss-in-zope2
- http://www.openwall.com/lists/oss-security/2016/09/05/5
- http://www.openwall.com/lists/oss-security/2016/09/05/4
- http://seclists.org/fulldisclosure/2016/Oct/80
- http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
- http://www.securityfocus.com/bid/92752
- http://www.securityfocus.com/archive/1/539572/100/0/threaded
- https://github.com/advisories/GHSA-chvw-gjxf-f8mc
CVE-2016-7140 · published · modified · JSON