Stored XSS Vulnerability in Plone by File Uploading SVG or HTML Files
CVE-2021-33512

5.4MEDIUM

Key Information:

Vendor

Plone

Status
Plone
Vendor
CVE Published:
21 May 2021

What is CVE-2021-33512?

Plone versions up to 5.2.4 are susceptible to stored Cross-Site Scripting (XSS) attacks, primarily due to improper handling of SVG and HTML document uploads by users with Contributor roles. This vulnerability allows attackers to exploit the system by uploading malicious files, which can then execute arbitrary scripts when accessed by unsuspecting users. To mitigate this issue, it is highly recommended to apply security updates and limit file upload functionalities based on user permissions. More detailed information can be found in the security hotfix documentation.

References

https://plone.org/security/hotfix/20210518/stored-xss-fro...
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2021/05/22/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.