PYSEC-2026-2884
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-event/PYSEC-2026-2884.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2884
- Aliases
- Published
- 2026-07-09T16:49:32Z
- Modified
- 2026-07-13T16:43:23Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- SSRF attacks via tracebacks in Plone
- Details
-
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-28735
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-x7wf-5mjc-6x76
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
- https://www.misakikata.com/codes/plone/python-en.html
- https://pypi.org/project/plone-app-event
Affected packages
PyPI / plone-app-event
Package
- Name
- plone-app-event
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone-app-event
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.2.10
Affected versions
1.*
1.0a1
1.0a2
1.0b1
1.0b2
1.0b3
1.0b4
1.0b5
1.0b6
1.0b7
1.0b8
1.0rc1
1.0rc2
1.0rc3
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.a1
1.1b1
1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.10
1.1.11
1.1.12
1.1.13
1.2
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
2.*
2.0a1
2.0a2
2.0a3
2.0a4
2.0a5
2.0a6
2.0a7
2.0a8
2.0a9
2.0a10
2.0a11
2.0a12
2.0a13
2.0b1
2.0b2
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1
3.1.1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9