GHSA-89rq-27xp-vgv7

Suggest an improvement
Source
https://github.com/advisories/GHSA-89rq-27xp-vgv7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89rq-27xp-vgv7/GHSA-89rq-27xp-vgv7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-89rq-27xp-vgv7
Aliases
Published
2022-05-17T04:49:45Z
Modified
2025-04-13T22:36:05Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Plone vulnerable to cross-site scripting
Details

Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T18:25:00Z",
    "nvd_published_at": "2014-03-11T19:37:00Z",
    "severity": "MODERATE"
}
References

Affected packages

PyPI / plone

Package

Name
plone
View open source insights on deps.dev
Purl
pkg:pypi/plone

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1
Fixed
4.1.1

Affected versions

3.*
3.2a1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.3b1
3.3rc1
3.3rc2
3.3rc3
3.3rc4
3.3rc5
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
4.*
4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0rc1
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1

Database specific

last_known_affected_version_range 
"<= 4.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89rq-27xp-vgv7/GHSA-89rq-27xp-vgv7.json"

PyPI / plone

Package

Name
plone
View open source insights on deps.dev
Purl
pkg:pypi/plone

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2
Fixed
4.2.6

Affected versions

4.*
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89rq-27xp-vgv7/GHSA-89rq-27xp-vgv7.json"

PyPI / plone

Package

Name
plone
View open source insights on deps.dev
Purl
pkg:pypi/plone

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3
Fixed
4.3.2

Affected versions

4.*
4.3
4.3.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89rq-27xp-vgv7/GHSA-89rq-27xp-vgv7.json"