GHSA-859j-668v-mrr6

Source

https://github.com/advisories/GHSA-859j-668v-mrr6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-859j-668v-mrr6/GHSA-859j-668v-mrr6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-859j-668v-mrr6

Aliases

Published

2022-05-14T03:49:57Z

Modified

2024-10-18T16:04:33.293482Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Products.CMFPlone XSS in profile home_page property

Details

A member of the Plone site could set javascript in the home_page property of their profile, and have this executed when a visitor clicks the home page link on the author page.

Database specific

{
    "nvd_published_at": "2018-01-03T18:29:00Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2023-07-26T22:20:41Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

PyPI / products-cmfplone

Package

Name: products-cmfplone; View open source insights on deps.dev
Purl: pkg:pypi/products-cmfplone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.3.17

Affected versions

4.*

4.0b1

4.1a1

4.1a2

4.1a3

4.1b1

4.1b2

4.1rc2

4.1rc3

4.1

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.2a1

4.2a2

4.2b1

4.2b2

4.2rc1

4.2rc2

4.2

4.2.0.1

4.2.1

4.2.1.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.3a1

4.3a2

4.3b1

4.3b2

4.3rc1

4.3

4.3.1

4.3.2

4.3.3

4.3.4

4.3.4.1

4.3.5

4.3.6

4.3.7

4.3.8rc1

4.3.8

4.3.9

4.3.10rc1

4.3.10

4.3.11

4.3.12

4.3.13

4.3.14

4.3.15

4.3.16

PyPI / products-cmfplone

Package

Name: products-cmfplone; View open source insights on deps.dev
Purl: pkg:pypi/products-cmfplone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.10

Affected versions

5.*

5.0

5.0.1

5.0.2

5.0.3rc1

5.0.3

5.0.3.1

5.0.4rc1

5.0.4

5.0.5rc1

5.0.5rc2

5.0.5

5.0.6rc1

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10rc1

PyPI / products-cmfplone

Package

Name: products-cmfplone; View open source insights on deps.dev
Purl: pkg:pypi/products-cmfplone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1a1

Fixed

5.1.0

Affected versions

5.*

5.1a1

5.1a2

5.1b2

5.1b3

5.1b4

5.1rc1

5.1rc2

PyPI / plone

Package

Name: plone; View open source insights on deps.dev
Purl: pkg:pypi/plone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5a1

Fixed

4.3.16

Affected versions

3.*

3.2a1

3.2rc1

3.2

3.2.1

3.2.2

3.2.3

3.3b1

3.3rc1

3.3rc2

3.3rc3

3.3rc4

3.3rc5

3.3

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

4.*

4.0a1

4.0a2

4.0a3

4.0a4

4.0a5

4.0b1

4.0b2

4.0b3

4.0b4

4.0b5

4.0rc1

4.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0.10

4.1a1

4.1a2

4.1a3

4.1b1

4.1b2

4.1rc2

4.1rc3

4.1

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.2a1

4.2a2

4.2b1

4.2b2

4.2rc1

4.2rc2

4.2

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.3a1

4.3a2

4.3b1

4.3b2

4.3rc1

4.3

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

4.3.8

4.3.9

4.3.10

4.3.11

4.3.12

4.3.13

4.3.14

4.3.15

PyPI / plone

Package

Name: plone; View open source insights on deps.dev
Purl: pkg:pypi/plone

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0a1

Fixed

5.1.0

Affected versions

5.*

5.0a1

5.0a2

5.0a3

5.0b1

5.0b2

5.0b3

5.0b4

5.0rc1

5.0rc2

5.0rc3

5.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10

5.1a1

5.1a2

5.1b1

5.1b2

5.1b3

5.1b4

5.1rc1

5.1rc2