CVE-2013-7062: Cross-Site Scripting (XSS) Vulnerabilities in Plone
Summary
CVE-2013-7062: Plone Zope cross-site scripting (XSS) vulnerability. Affects plone across 4 version ranges.
>= 3.3, < 3.3.6
>= 4.0, < 4.0.9
>= 4.1, < 4.1.6
>= 4.3, < 4.3.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used by organizations and individuals to build and maintain their websites.
Plone versions 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2 are affected by multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The identified vulnerabilities in Plone allow remote attackers to inject arbitrary web script or HTML into the application. These vulnerabilities exist in the 'browser_id_manager' and 'OFS.Image' methods. By exploiting these vulnerabilities, an attacker can execute malicious scripts or inject harmful content into web pages, potentially leading to various attacks such as session hijacking, phishing, or defacement of the affected website.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3, < 3.3.63.3.6pip install --upgrade "plone==3.3.6" -
>= 4.0, < 4.0.94.0.9pip install --upgrade "plone==4.0.9" -
>= 4.1, < 4.1.64.1.6pip install --upgrade "plone==4.1.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization measures in the affected methods. This can be done by using appropriate security libraries or frameworks that provide protection against XSS attacks. Here is an example of how input validation can be performed in Python:
import re
def sanitize_input(input):
# Remove any script tags
sanitized_input = re.sub(r'<script.*?>.*?</script>', '', input)
# Perform additional sanitization steps
# ...
return sanitized_input
Conclusion
The identified cross-site scripting (XSS) vulnerabilities in Plone can potentially allow remote attackers to inject malicious scripts or HTML into web pages. To mitigate these vulnerabilities, it is crucial to upgrade to the fixed versions of Plone. Implementing input validation and sanitization measures can serve as a temporary workaround until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
The vulnerabilities in Plone can be exploited by an attacker who can submit specially crafted input to the 'browser_id_manager' or 'OFS.Image' methods. By injecting malicious scripts or HTML, the attacker can manipulate the behavior of the affected web pages and potentially compromise the security of the application.
No, not all versions of Plone are affected. The vulnerabilities exist in Plone versions 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2. It is recommended to upgrade to the fixed versions mentioned earlier.
The consequences of these vulnerabilities can vary depending on the attacker's intentions and the security measures in place. Possible consequences include unauthorized access to sensitive information, session hijacking, phishing attacks, defacement of the affected website, and the execution of arbitrary code on the user's browser.
You can find more information about these vulnerabilities in the Plone advisory database. The source for this specific vulnerability is available at: https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2020-218.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
