Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
82 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
Recommended action: Upgrade to 6.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet.
Recommended action: Upgrade to 5.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.
Recommended action: Upgrade to 5.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.
Recommended action: Upgrade to 5.2.2, 5.1.7 or 4.3.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Recommended action: Upgrade to 5.2.2, 5.1.7 or 4.3.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.5 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safehtml transform.
Recommended action: Upgrade to 3.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in skins/plonetemplates/defaulterrormessage.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the typename parameter to Members/ipa/createObject.
Recommended action: Upgrade to 2.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
Recommended action: Upgrade to 4.1.1, 4.0.10 or 4.2a3 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
Recommended action: Upgrade to 4.3.2 or 4.2.6 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
(1) cbdecode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
Recommended action: Upgrade to 4.3.2 or 4.2.6 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple open redirect vulnerabilities in (1) marmosetpatch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
memberportrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.
Recommended action: Upgrade to 4.3.2, 4.2.6 or 4.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.
Recommended action: Upgrade to 4.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
Recommended action: Upgrade to 4.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
Recommended action: Upgrade to 4.2.3 or 4.3b1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
Recommended action: Upgrade to 4.2.3 or 4.3b1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.