PYSEC-2023-311

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/plone-namedfile/PYSEC-2023-311.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2023-311
Aliases
Related
Published
2023-09-21T15:15:10Z
Modified
2025-04-09T17:59:08.955429Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

plone.namedfile allows users to handle File and Image fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.

References

Affected packages

PyPI / plone-namedfile

Package

Affected ranges

Type
GIT
Repo
https://github.com/plone/plone.namedfile
Events
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.6.1
Introduced
6.0.0
Fixed
6.0.3
Introduced
6.1.0
Fixed
6.1.3

Affected versions

1.*

1.0a1
1.0b1
1.0b2
1.0b3
1.0b4
1.0b5
1.0b6
1.0b7
1.0b8
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6

2.*

2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.1.0

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11

4.*

4.0
4.1
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3.0

5.*

5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.4.0
5.5.0
5.5.1
5.6.0

6.*

6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.1.2