CVE-2021-3313
MEDIUM6.1EPSS 0.44%Plone XSS in User Fullname Property and File Upload
發布日:2022/5/24修改日:2024/10/15
描述
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
受影響套件(2)
- PyPI/plonefrom 0, < 5.2.4
- PyPI/plonefrom 0, < 5.2.4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
參考連結(9)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-3313
- PATCHhttps://github.com/plone/Plone
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-78.yaml
- WEBhttps://plone.org/download/releases/5.2.3
- WEBhttps://plone.org/security/hotfix/20210518
- WEBhttps://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html
- WEBhttps://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname
- WEBhttps://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt
- WEBhttp://www.openwall.com/lists/oss-security/2021/05/22/1