CVE-2016-7140

MEDIUM

Plone 3.3.x-3.3.6 4.x-4.3.11 5.x-5.0.6 - Cross-Site Scripting

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References (7)

Core 7

Core References

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html

Third Party Advisory, VDB Entry mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2016/Oct/80

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/05/4

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/05/5

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/539572/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92752

Vendor Advisory x_refsource_confirm

https://plone.org/security/hotfix/20160830/non-persistent-xss-in-zope2

Scores

CVSS v3 6.1

EPSS 0.0158

EPSS Percentile 72.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (46)

plone/plone 3.3

plone/plone 3.3.1

plone/plone 3.3.2

plone/plone 3.3.3

plone/plone 3.3.4

plone/plone 3.3.5

plone/plone 3.3.6

plone/plone 4.0

plone/plone 4.0.1

plone/plone 4.0.2

... and 36 more

Published Mar 07, 2017

Tracked Since Feb 18, 2026