Cross-site Scripting (XSS) Affecting plone package, versions [4,5.1a1]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.41% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-PLONE-40416
  • published18 Jul 2016
  • disclosed18 Jul 2016
  • creditUnknown

Introduced: 18 Jul 2016

CVE-2016-7136  (opens in a new tab)
CWE-79  (opens in a new tab)

Overview

plone is a Content Management System.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks.

z3c.form will currently accept data from GET requests when the form is supposed to be POST. This allows a user to inject a potential XSS attack into a form. With certain widgets in Plone admin forms, the input is expected to be safe and can cause a reflexive XSS attack. Additionally, there is potential for an attack that will trick a user into saving a persistent XSS.

Details

<>

CVSS Scores

version 3.1