CVE-2016-7138

MEDIUM

Plone 3.3.x-3.3.6 4.x-4.3.11 5.x-5.0.6 - Cross-Site Scripting via URL Checking Infrastructure

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

References (7)

Core 7

Core References

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html

Vendor Advisory x_refsource_confirm

https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1

Third Party Advisory, VDB Entry mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2016/Oct/80

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/05/4

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/05/5

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/539572/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92752

Scores

CVSS v3 6.1

EPSS 0.0160

EPSS Percentile 73.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (46)

plone/plone 3.3

plone/plone 3.3.1

plone/plone 3.3.2

plone/plone 3.3.3

plone/plone 3.3.4

plone/plone 3.3.5

plone/plone 3.3.6

plone/plone 4.0

plone/plone 4.0.1

plone/plone 4.0.2

... and 36 more

Published Mar 07, 2017

Tracked Since Feb 18, 2026