CVE-2024-0669: Plone CMS Cross-Frame Scripting Vulnerability
Summary
CVE-2024-0669: Cross-Frame Scripting vulnerability has been found on Plone CMS. Affects plone versions < 6.0.7. Fixed in 6.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone CMS is an open-source content management system built on Python, designed for managing web content with a focus on security, scalability, and ease of use. It allows users to create, edit, and publish content while providing robust features such as version control, user management, and customizable workflows. However, versions prior to 6.0.5 are vulnerable to a Cross-Frame Scripting attack, which can compromise the integrity of the application.
Vulnerability Detail
A Cross-Frame Scripting vulnerability has been identified in Plone CMS, affecting versions below 6.0.5. This vulnerability allows an attacker to store a malicious URL that can be opened by an administrator, leading to the execution of a malicious iframe element. The attacker can exploit this vulnerability to manipulate the content displayed to the administrator, potentially leading to unauthorized actions or data exposure.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.7
This is the first release that contains the fix.
pip install --upgrade "plone==6.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should avoid clicking on untrusted links or URLs that could lead to malicious content. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the risk by restricting the sources from which iframes can be loaded.
Conclusion
The Cross-Frame Scripting vulnerability in Plone CMS poses a significant risk to users of versions below 6.0.5. It is crucial to update to version 6.0.7 or later to mitigate this risk. Additionally, implementing workarounds and monitoring for vulnerabilities can enhance the security of your application.
See every vulnerability recorded for plone →
FAQ
Cross-Frame Scripting is a type of security vulnerability that allows an attacker to inject malicious content into a web page, which can then be executed in the context of another user's session.
If you are using Plone CMS version 6.0.5 or earlier, your installation is vulnerable to this issue. You can check your version by running pip show plone in your terminal.
If exploited, this vulnerability could allow attackers to manipulate the content seen by administrators, potentially leading to unauthorized actions, data breaches, or further exploitation of the system.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.1, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
