CVE-2020-28736: XXE attacks in Plone before 5.2.3
Summary
CVE-2020-28736: Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). Affects plone versions < 5.2.3. Fixed in 5.2.3. How to fix ↓
Also tracked for
- plone-app-dexterity · PyPI
- plone-app-event · PyPI
- plone-app-theming · PyPI
- plone-supermodel · PyPI
The same CVE-2020-28736 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone allows users to easily create and customize content types using the plone.schemaeditor.ManageSchemata feature. However, prior to version 5.2.3, this feature was vulnerable to XXE (XML External Entity) attacks.
Vulnerability Detail
The vulnerability in Plone before 5.2.3 arises from the lack of proper permission checks on the plone.schemaeditor.ManageSchemata feature. This means that only users with the Manager role can access and utilize this feature. However, an attacker with the Manager role can exploit this vulnerability to launch XXE attacks. By submitting specially crafted XML data, an attacker can trigger the parsing of external entities, leading to various security risks such as disclosure of internal files, denial of service, or server-side request forgery.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.3
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the plone.schemaeditor.ManageSchemata feature by modifying the permissions assigned to the Manager role. This can be done by navigating to the Plone site's control panel, selecting 'Security' and then 'Roles and Permissions'. From there, the permissions for the Manager role can be adjusted to limit access to the vulnerable feature.
Conclusion
The vulnerability in Plone before 5.2.3 allows XXE attacks through the plone.schemaeditor.ManageSchemata feature. Upgrading to version 5.2.3 or later is the recommended solution to fix this vulnerability. Administrators can also temporarily restrict access to the vulnerable feature by adjusting the permissions assigned to the Manager role. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
XXE (XML External Entity) is a type of vulnerability that allows an attacker to exploit the processing of XML data by including external entities. This can lead to various security risks such as disclosure of internal files, denial of service, or server-side request forgery.
Plone versions before 5.2.3 are affected by this vulnerability. Specifically, users with the Manager role are at risk of being able to launch XXE attacks through the plone.schemaeditor.ManageSchemata feature.
Exploiting this vulnerability can result in the disclosure of sensitive information, denial of service attacks, or server-side request forgery. It is important to upgrade to the fixed version to mitigate these risks.
To fix this vulnerability, it is recommended to upgrade to Plone version 5.2.3 or later. This version includes the necessary permission checks to prevent unauthorized access to the plone.schemaeditor.ManageSchemata feature.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
