CVE-2020-28734: XXE attacks in Plone before 5.2.3
Summary
CVE-2020-28734: Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. Affects plone versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Also tracked for
- plone-app-dexterity · PyPI
- plone-app-event · PyPI
- plone-app-theming · PyPI
- plone-supermodel · PyPI
The same CVE-2020-28734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone allows users to easily create and publish content, manage workflows, and customize the appearance and functionality of their sites. However, prior to version 5.2.3, Plone is vulnerable to XXE (XML External Entity) attacks.
Vulnerability Detail
The vulnerability in Plone before 5.2.3 allows XXE attacks through a feature that is explicitly only available to the Manager role. XXE attacks occur when an application parses XML input without disabling external entity references, allowing an attacker to read arbitrary files on the server or perform other malicious actions. In the case of Plone, an attacker with the Manager role can exploit this vulnerability to execute arbitrary code, access sensitive information, or cause denial of service.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.3
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Plone 5.2.3 is not immediately feasible, a temporary workaround is to restrict access to the vulnerable feature. This can be done by modifying the permissions and access controls in the Plone configuration to prevent the Manager role from accessing the feature. However, applying the workaround is not a permanent solution, and it is strongly recommended to upgrade to the latest version of Plone as soon as possible.
Conclusion
In conclusion, Plone versions before 5.2.3 are vulnerable to XXE attacks through a feature accessible to the Manager role. To mitigate this vulnerability, it is crucial to upgrade to Plone 5.2.3 or later. Restricting access to the vulnerable feature can serve as a temporary workaround, but it is not a substitute for upgrading. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
XXE (XML External Entity) is a type of vulnerability that occurs when an application parses XML input without disabling external entity references. It allows an attacker to read arbitrary files on the server, perform remote code execution, or conduct other malicious activities.
Plone versions before 5.2.3 are affected by this vulnerability. Specifically, the vulnerability can be exploited by users with the Manager role.
An attacker with the Manager role can exploit this vulnerability to execute arbitrary code, access sensitive information, or cause denial of service. They can read arbitrary files on the server, potentially exposing sensitive data, or perform other malicious actions.
Yes, the vulnerability can be fixed by upgrading to Plone version 5.2.3 or later. This version includes a patch for the XXE vulnerability and restricts access to the vulnerable feature.
A temporary workaround is to modify the permissions and access controls in the Plone configuration to prevent the Manager role from accessing the vulnerable feature. However, it is strongly recommended to upgrade to the latest version of Plone for a permanent solution.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
