CVE-2021-33511: SSRF Vulnerability in Plone
Summary
CVE-2021-33511: Plone though 5.2.4 allows SSRF via the lxml parser. Affects plone versions < 5.2.5. Fixed in 5.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone is widely used in various industries and has a large community of developers and users. However, versions up to 5.2.4 are vulnerable to a Server-Side Request Forgery (SSRF) attack through the lxml parser. This vulnerability affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
Vulnerability Detail
The SSRF vulnerability in Plone allows an attacker to make arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources or remote code execution. By exploiting this vulnerability, an attacker can bypass security measures and interact with internal systems or perform actions on behalf of the server. This can result in data leakage, privilege escalation, or the compromise of sensitive information. The vulnerability arises due to improper input validation and insufficient restrictions on the types of requests that can be made.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.5
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the lxml parser in Plone. This can be achieved by modifying the Plone configuration to use an alternative parser that is not vulnerable to SSRF attacks. Here is an example of how to disable the lxml parser in the buildout configuration:
[instance] ... environment-vars += ELEMENTTREE_IMPLEMENTATION=python
After making this change, restart the Plone instance for the configuration to take effect. However, it is strongly recommended to upgrade to the latest version as soon as possible.
Conclusion
The SSRF vulnerability in Plone can have serious security implications, allowing attackers to bypass security measures and potentially compromise sensitive information. It is crucial for Plone users to upgrade to the latest version (5.2.5 or later) or apply the provided workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources or remote code execution.
Plone versions up to 5.2.4 are affected by this SSRF vulnerability.
Exploiting this vulnerability can result in data leakage, privilege escalation, or the compromise of sensitive information. An attacker can bypass security measures and interact with internal systems or perform actions on behalf of the server.
To mitigate the risk of exploitation, it is recommended to upgrade to Plone version 5.2.5 or later. Alternatively, you can temporarily disable the lxml parser in Plone as a workaround until the upgrade is performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
