CVE-2016-7147: Plone XSS in Zope ZMI
Summary
CVE-2016-7147: Plone XSS in Zope ZMI. Affects plone across 2 version ranges.
>= 4.0, < 4.3.12
>= 5.0, < 5.0.7
Fixed in 4.3.12 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and content. The Zope ZMI (Zope Management Interface) is a web-based administrative interface for managing Plone sites. This vulnerability affects Plone versions before 4.3.12 and 5.x before 5.0.7. The vulnerability allows remote attackers to inject arbitrary web script or HTML through the search feature in Zope ZMI, specifically in the manage_findResult component. This vulnerability is a result of an incomplete fix for CVE-2016-7140.
Vulnerability Detail
The vulnerability in Plone allows attackers to perform cross-site scripting (XSS) attacks by exploiting the search feature in Zope ZMI. By manipulating the obj_ids:tokens parameter, an attacker can inject malicious web script or HTML code. This can lead to various consequences, including the execution of arbitrary code in the context of the victim's browser, stealing sensitive information, or performing actions on behalf of the victim. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.3.124.3.12pip install --upgrade "plone==4.3.12" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "plone==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable or restrict access to the Zope ZMI interface. This can be achieved by modifying the server configuration or using access control mechanisms to limit access to trusted users only. By limiting access to the vulnerable component, the risk of exploitation can be mitigated.
Conclusion
The Plone XSS vulnerability in Zope ZMI can be exploited by remote attackers to inject malicious web script or HTML. Upgrading to the fixed versions of Plone (4.3.12 or later for versions before 4.3.12, and 5.0.7 or later for versions 5.x before 5.0.7) is the recommended solution. If immediate upgrading is not possible, restricting access to the vulnerable component can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and content.
Zope ZMI (Zope Management Interface) is a web-based administrative interface for managing Plone sites. It allows users to perform various administrative tasks and configure the Plone environment.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the victim's browser and potential theft of sensitive information.
This vulnerability allows remote attackers to inject arbitrary web script or HTML into the search feature of Zope ZMI in Plone. The injected code can be used to perform various malicious actions, such as stealing sensitive information or executing arbitrary code in the victim's browser.
To mitigate the risk of exploitation, it is recommended to upgrade to a fixed version of Plone as soon as possible. If immediate upgrading is not feasible, restricting access to the vulnerable component, such as the Zope ZMI interface, can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
