CVE-2020-7937

MEDIUM

Plone 5.0-5.2.1 - Stored Cross-Site Scripting in Title Field

Title source: llm

Description

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.

References (4)

Core 4

Core References

Vendor Advisory x_refsource_misc

https://plone.org/security/hotfix/20200121

Mailing List, Third Party Advisory x_refsource_misc

https://www.openwall.com/lists/oss-security/2020/01/22/1

Vendor Advisory x_refsource_misc

https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher

Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2020/01/24/1

Scores

CVSS v3 5.4

EPSS 0.0080

EPSS Percentile 52.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

plone/plone 5.0 - 5.2.1

pypi/Plone 5.0PyPI

Published Jan 23, 2020

Tracked Since Feb 18, 2026