CVE-2021-33512: Cross-site scripting in Plone
Summary
CVE-2021-33512: Cross-site scripting in Plone. Affects plone versions < 5.2.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone is written in Python and offers a wide range of features, including a powerful security model, extensibility through add-ons, and a user-friendly interface. However, Plone versions up to 5.2.4 are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Plone allows a Contributor to perform stored XSS attacks by uploading an SVG or HTML document. This means that an attacker with Contributor privileges can upload a malicious file containing JavaScript code, which will be executed when other users view the file. This can lead to various security issues, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can disable the ability for Contributors to upload SVG or HTML files. This can be done by modifying the Plone configuration to restrict the allowed file types for upload. Here is an example of how to modify the configuration file:
# Disable SVG and HTML file uploads
allowed_file_types = ['image/jpeg', 'image/png', 'application/pdf']
Conclusion
In conclusion, Plone versions up to 5.2.4 are vulnerable to a stored XSS attack, which can be exploited by uploading malicious SVG or HTML files. To mitigate this vulnerability, it is crucial to upgrade to a patched version of Plone and ensure proper validation of user-uploaded files. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
Stored cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious scripts into a website or web application. These scripts are then executed by other users who visit the affected pages, potentially leading to various security issues.
The consequences of this vulnerability can vary depending on the attacker's intentions. Possible ramifications include stealing sensitive information, session hijacking, or performing actions on behalf of the user.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use Vulert, a vulnerability monitoring tool, to check if your Plone installation is affected by this vulnerability. Vulert analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
