CVE-2021-33510: SSRF vulnerability in Plone
Summary
CVE-2021-33510: Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. Affects plone versions < 5.2.5. Fixed in 5.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone is written in Python and offers a wide range of features, including a powerful security model, extensibility through add-ons, and a user-friendly interface. However, Plone versions up to 5.2.4 are vulnerable to a Server-Side Request Forgery (SSRF) attack.
Vulnerability Detail
The SSRF vulnerability in Plone allows remote authenticated managers to exploit the system by sending a specially crafted event iCal URL. By manipulating the URL, an attacker can read one line of a file on the server. This can lead to unauthorized access to sensitive information, such as configuration files or user data. The vulnerability poses a significant risk to the confidentiality and integrity of the affected Plone installations.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.5
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the latest version of Plone to mitigate the risk.
Conclusion
The SSRF vulnerability in Plone versions up to 5.2.4 can be exploited by remote authenticated managers to read one line of a file on the server. This poses a significant risk to the confidentiality and integrity of the affected Plone installations. To mitigate this vulnerability, it is crucial to upgrade to Plone version 5.2.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
Server-Side Request Forgery (SSRF) is a type of vulnerability that allows an attacker to make requests from the vulnerable server to other internal or external resources. In this case, the SSRF vulnerability in Plone allows an authenticated manager to read one line of a file on the server.
The SSRF vulnerability in Plone can lead to unauthorized access to sensitive information stored on the server. This includes configuration files, user data, and potentially other confidential data. It poses a significant risk to the confidentiality and integrity of the affected Plone installations.
To fix this vulnerability, it is recommended to upgrade to Plone version 5.2.5 or later. The latest release includes a patch that addresses the SSRF vulnerability. Users should update their Plone installations as soon as possible to ensure the security of their systems.
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the latest version of Plone to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
