Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code. This is exploitable by any authenticated user who can configure a Classic portlet - which, with the default role map, includes regular users on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process. Patches The problem has been patched in plone.app.portlets For Plone 6.2, upgrade to plone.app.portlets 7.0.2. For Plone 6.1, upgrade to plone.app.portlets 6.0.4. For Plone 6.0, upgrade to plone.app.portlets 5.0.8. Workarounds If upgrading is…
Recommended action: Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url. Patches The problem has been patched in plone.app.portlets. For Plone 6.2: upgrade to plone.app.portlets 7.0.2 For Plone 6.1: upgrade to plone.app.portlets 6.0.4 For Plone 6.0: upgrade to plone.app.portlets 5.0.8 Workarounds If upgrading is not immediately possible: - Restrict who can manage portlets: remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles). - Where the RSS portlet is not needed, unregister it so it cannot be added. This would need to be…
Recommended action: Upgrade to 7.0.2, 6.0.4 or 5.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.