Stored Cross-Site Scripting in Plone Content Management System
CVE-2021-33508

5.4MEDIUM

Key Information:

Vendor

Plone

Status
Plone
Vendor
CVE Published:
21 May 2021

What is CVE-2021-33508?

The Plone Content Management System is susceptible to a stored cross-site scripting vulnerability due to improper handling of full names during the rendering of the ownership tab of content items. This flaw can allow an attacker to inject malicious scripts, potentially compromising the security of the application and its users. To protect against this vulnerability, users and administrators should upgrade to the latest version of Plone or apply the necessary security hotfix.

References

https://plone.org/security/hotfix/20210518/stored-xss-fro...
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2021/05/22/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.