CVE-2013-4190

MEDIUM4.7EPSS 0.26%

Plone vulnerable to cross-site scripting

發布日:2022/5/17修改日:2025/4/13

也稱為:GHSA-89rq-27xp-vgv7PYSEC-2014-54

描述

Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

受影響套件(2)

PyPI/plone>= 2.1, < 4.1.1
PyPI/plone>= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
osv	CVSS 3.1	MEDIUM4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-4190
PATCHhttps://github.com/plone/Plone
WEBhttp://plone.org/products/plone-hotfix/releases/20130618
WEBhttp://plone.org/products/plone/security/advisories/20130618-announcement
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=978451
WEBhttp://seclists.org/oss-sec/2013/q3/261
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-54.yaml