CVE-2021-3313: Plone XSS in User Fullname Property and File Upload
Summary
CVE-2021-3313: Plone XSS in User Fullname Property and File Upload. Affects plone versions < 5.2.4. Fixed in 5.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is a Content Management System (CMS) written in Python and is widely used for building websites, intranets, and web applications. It provides a user-friendly interface for managing content and has a robust set of features for customization and extensibility. However, Plone versions prior to 5.2.4 are vulnerable to a stored Cross-Site Scripting (XSS) attack. This vulnerability affects the user fullname property and the file upload functionality. When user input data is echoed back to the user, it is not properly encoded, allowing an attacker to inject malicious JavaScript code. If a victim opens a vulnerable page containing an XSS payload, the attacker can execute arbitrary code in the victim's browser.
Vulnerability Detail
The stored XSS vulnerability in Plone arises due to improper encoding of user input data. This allows an attacker to inject malicious JavaScript code, which is then executed in the context of the victim's browser. The impact of this vulnerability can range from stealing sensitive information, such as login credentials or personal data, to performing actions on behalf of the victim, such as making unauthorized changes to their account or performing actions with elevated privileges. The vulnerability has been assigned the CVE identifier CVE-2021-3313 and the PySEC identifier PYSEC-2021-78.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.4
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Plone 5.2.4 or later is not immediately feasible, a temporary workaround is to implement input validation and sanitization measures. This can be done by implementing server-side validation of user input and properly encoding any user-generated content before displaying it to other users. Additionally, implementing a Content Security Policy (CSP) can help mitigate the impact of XSS attacks by restricting the execution of inline scripts and enforcing strict source policies for external scripts.
Conclusion
Plone versions prior to 5.2.4 are susceptible to a stored XSS vulnerability in the user fullname property and file upload functionality. This vulnerability allows an attacker to inject and execute malicious JavaScript code in the victim's browser. To mitigate this risk, it is recommended to upgrade to Plone 5.2.4 or later, which includes a fix for this vulnerability. Implementing input validation, sanitization, and a Content Security Policy (CSP) can provide additional layers of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is a Python-based Content Management System (CMS) used for building websites, intranets, and web applications. It offers a user-friendly interface and extensive customization options.
A stored XSS vulnerability allows an attacker to inject malicious code that is permanently stored on a target website or application. When other users access the affected page, the injected code is executed in their browsers.
An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various malicious activities, such as stealing sensitive information, performing actions on behalf of the victim, or spreading malware.
To protect your Plone application, it is crucial to upgrade to version 5.2.4 or later, which includes a fix for this vulnerability. Additionally, implementing input validation, sanitization, and a Content Security Policy (CSP) can further mitigate the risk of XSS attacks.
Yes, you can use Vulert's vulnerability monitoring tool to check if your Plone application is affected by this vulnerability. Vulert uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities, providing valuable insights and recommendations for remediation.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
