CVE-2017-1000482: Plone - JavaScript Execution in Home Page Property
Summary
CVE-2017-1000482: Products.CMFPlone XSS in profile home_page property. Affects products-cmfplone across 3 version ranges.
< 4.3.17
>= 5.0.0, < 5.0.10
>= 5.1a1, < 5.1.0
Fixed in 4.3.17, 5.0.10 or 5.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- plone · PyPI
The same CVE-2017-1000482 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone versions 2.5 to 5.1rc1 are affected by a vulnerability that allows a user to inject and execute JavaScript code through the home_page property of their profile. This code is executed when a visitor clicks the home page link on the author page.
Vulnerability Detail
The vulnerability in Plone allows an attacker with a user account on the site to insert malicious JavaScript code into their profile's home_page property. When a visitor accesses the author page and clicks the home page link, the injected JavaScript code is executed in the visitor's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, or the execution of arbitrary actions on behalf of the visitor. The vulnerability affects Plone versions 2.5 to 5.1rc1.
How To Fix
Latest published version: 6.2.2 as of 22 Oct 2026
pip install --upgrade "products-cmfplone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.174.3.17pip install --upgrade "products-cmfplone==4.3.17" -
>= 5.0.0, < 5.0.105.0.10pip install --upgrade "products-cmfplone==5.0.10" -
>= 5.1a1, < 5.1.05.1.0pip install --upgrade "products-cmfplone==5.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the display of the home page link on the author page. This can be achieved by modifying the template or configuration responsible for rendering the author page. By removing or commenting out the code that generates the home page link, the execution of the injected JavaScript code can be prevented. However, this workaround may impact the user experience and should be considered temporary until the Plone installation is updated to a fixed version.
Conclusion
The vulnerability in Plone versions 2.5 to 5.1rc1 allows an attacker to execute arbitrary JavaScript code in the visitor's browser through the home_page property of their profile. To mitigate this vulnerability, it is recommended to upgrade to a fixed version of Plone (4.3.16 or 5.1.0 or later) and review user input for sanitization. A temporary workaround is available by disabling the display of the home page link on the author page. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for products-cmfplone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management.
Plone versions 2.5 to 5.1rc1 are affected by this vulnerability.
The vulnerability allows an attacker to execute arbitrary JavaScript code in the visitor's browser when they click the home page link on the author page. This can lead to unauthorized access, session hijacking, or the execution of malicious actions on behalf of the visitor.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Plone (4.3.16 or 5.1.0 or later). Additionally, review and sanitize user input to prevent the injection of malicious code.
Yes, a temporary workaround is to disable the display of the home page link on the author page. This can be achieved by modifying the template or configuration responsible for rendering the author page.
References
Related vulnerabilities
Recent vulnerabilities recorded for products-cmfplone.
