Sensitive Information Exposure in Plone CMS
CVE-2021-33926

8.8HIGH

Key Information:

Vendor

Plone

Status
Plone
Vendor
CVE Published:
17 February 2023

What is CVE-2021-33926?

In Plone CMS, versions 5.2.4 through 4.3.20 are vulnerable to a flaw allowing attackers to exploit its RSS feed functionality. This weakness enables unauthorized access to sensitive information by leveraging a blind Server-Side Request Forgery (SSRF) attack, which can potentially expose internal resources and data. Implementing the latest patches and following security best practices is essential to mitigate these risks.

References

https://plone.org/security/hotfix/20210518
https://github.com/s-kustm/Subodh/blob/master/Plone%205.2...
https://plone.org/security/hotfix/20210518/blind-ssrf-via...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.