Reflected Cross-Site Scripting Vulnerability in Plone by Zope Products
CVE-2021-33507

6.1MEDIUM

Key Information:

Vendor

Plone

Status
Plone
Zope
Vendor
CVE Published:
21 May 2021

What is CVE-2021-33507?

Certain versions of Zope Products.CMFCore and Products.PluggableAuthService, found in Plone, are susceptible to reflected cross-site scripting (XSS) attacks. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users. Attackers can exploit this weakness to manipulate user sessions or gain sensitive information, highlighting the importance of upgrading to the latest versions to enhance security.

References

https://plone.org/security/hotfix/20210518/reflected-xss-...
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2021/05/22/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.