Plone has stored XSS in folder contents

보통 5.4CVE-2021-35959 · GHSA-qfhw-fv3g-v836 · PYSEC-2021-110 · Published 30/06/2021 · updated 17/06/2026

요약

CVE-2021-35959은(는) plone, plone (plone)에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.54%, 전체 취약점의 45.5%보다 높음.
조치: 5.2.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
plone PyPI	`≥ 5.0, ≤ 5.2.4≥ 5.0, < 5.2.5`	`5.2.5`
plone plone	`≥ 5.0, ≤ 5.2.4`	No fix yet

Description

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

NVD description

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

References

nvd.nist.gov/vuln/detail/CVE-2021-35959 · ADVISORY
plone/Plone · PACKAGE
pypa/advisory-database · WEB
plone.org/security/hotfix/20210518/stored-xss-in-folder-contents · WEB
openwall.com/lists/oss-security/2021/06/30/2 · WEB
GitHub Advisory GHSA-qfhw-fv3g-v836 · ADVISORY

plone의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

plone

PyPI

≥ 5.0, ≤ 5.2.4≥ 5.0, < 5.2.5

5.2.5

plone

≥ 5.0, ≤ 5.2.4

No fix yet

Description

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

NVD description

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

plone의 다른 취약점

모두 보기 →