{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.2.3"}],"component":"plone","cve_ids":["CVE-2021-29002"],"ecosystem":"PyPI","epss":0.00759,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-38g6-x6jv-jwff","id":"tcs_01M5KGFSX8TQSXCY784ZF4ETAK","modified_at":"2024-11-25T22:42:14.202673Z","published_at":"2021-03-24T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-889","https://www.exploit-db.com/exploits/49668","https://github.com/plone/Products.CMFPlone/issues/3255"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2021-889","url":"https://osv.dev/vulnerability/PYSEC-2021-889"}],"summary":"A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the \"form.widgets.site_title\" parameter."}