Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3313

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.

Published

2021-05-20T16:15:08.283

Last Modified

2024-11-21T06:21:16.067

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	plone	plone	< 5.2.4	Yes

References

http://www.openwall.com/lists/oss-security/2021/05/22/1 Mailing List, Third Party Advisory ([email protected])
https://plone.org/download/releases/5.2.3 Release Notes, Vendor Advisory ([email protected])
https://plone.org/security/hotfix/20210518 Vendor Advisory ([email protected])
https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt Exploit, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/05/22/1 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://plone.org/download/releases/5.2.3 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://plone.org/security/hotfix/20210518 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)