CVE-2011-1340

Plone < 2.5.3 - Cross-Site Scripting via type_name Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.

References (4)

Core 4
Core References
Exploit x_refsource_confirm
http://dev.plone.org/plone/ticket/6110
Third Party Advisory third-party-advisory x_refsource_jvndb
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000056
Third Party Advisory third-party-advisory x_refsource_jvn
http://jvn.jp/en/jp/JVN41222793/index.html
Patch x_refsource_confirm
http://dev.plone.org/plone/changeset/12262

Scores

EPSS 0.0114
EPSS Percentile 63.3%

Details

CWE
CWE-79
Status published
Products (22)
plone/plone 1.0
plone/plone 1.0.1
plone/plone 1.0.2
plone/plone 1.0.3
plone/plone 1.0.4
plone/plone 1.0.5
plone/plone 1.0.6
plone/plone 2.0
plone/plone 2.0.1
plone/plone 2.0.2
... and 12 more
Published Aug 05, 2011
Tracked Since Feb 18, 2026